Inbound BYO SIP Trunk - 401 Unauthorized (IP-auth ...
# support
s
Hi! I have an issue with inbound BYO SIP Trunking. My carrier (Inbtel/PBXHosting, Sippy Softswitch) sends INVITEs from IP 207.182.145.2 to sip:526627760699@sip.vapi.ai:5060 but Vapi always responds 401 Unauthorized (Digest challenge). The carrier operates in IP-auth mode only and cannot respond to Digest challenges. What I already configured: BYO SIP Trunk credential with IP 207.182.145.2, inboundEnabled=true (ID: 8516b872-087a-48ee-a1b0-c75c91413fe0) SIP URI phone number sip:526627760699@sip.vapi.ai (ID: 57ac14e5-e307-4ef4-b441-f9383a5a2794) The problem: Vapi still sends 401 Unauthorized on every inbound INVITE. I have a PCAP proving the traffic reaches Vapi correctly. org ID: c72786ec-d64f-4f80-a79a-c47f504a73c2 Can you help enable IP-auth (trusted peer, no Digest) for inbound INVITEs from 207.182.145.2 for this org? https://cdn.discordapp.com/attachments/1502458171229470811/1502458171501973504/401_526627760699.pcap?ex=69ffc8b6&is=69fe7736&hm=920ae155866c5eda9510b27920808856149b7d5af4c4bb1d331c195cf327ad58& https://cdn.discordapp.com/attachments/1502458171229470811/1502458171955089589/dump_1_166.pcap?ex=69ffc8b6&is=69fe7736&hm=f4ac08a2f8456a43098e37d55f94aaefa69ee7f9d0a68f9ac63aba69328c3f04&
m
Hey, @Saul this is a known friction point with Vapi's BYO SIP trunking when the carrier is IP-auth only. The 401 loop happens because Vapi defaults to Digest challenge even when a trusted peer IP is configured, and there's a backend flag needed to bypass that for your org. I can get this sorted for you directly. Quick question: is the INVITE hitting sip.vapi.ai on port 5060 with the full DID in the Request-URI, or is the carrier sending it to a different format?
s
Hi Matt! Thanks for the quick response. Yes, the INVITE is hitting sip.vapi.ai on port 5060 UDP with the full DID in the Request-URI: INVITE sip:526627760699@sip.vapi.ai:5060 SIP/2.0 The carrier (Sippy Softswitch) sends it from 207.182.145.2:5060. Vapi responds 401, then the carrier retries directly to the resolved IP 44.238.177.138:5060 (same Request-URI user 526627760699) and Vapi responds 200 OK but sends a BYE after ~1.5 seconds. So the INVITE format is correct — the issue is purely the 401 on the FQDN and the premature BYE on the IP retry. Please go ahead and set that backend flag for our org. org ID: c72786ec-d64f-4f80-a79a-c47f504a73c2 Credential ID: 8516b872-087a-48ee-a1b0-c75c91413fe0 Phone Number ID: 57ac14e5-e307-4ef4-b441-f9383a5a2794 Trusted peer IP: 207.182.145.2
Hi Matt, following up on this thread. We provided all the details yesterday (org ID, credential ID, phone number ID, and trusted peer IP). Could you confirm if the backend flag has been set for our org? We're experiencing active call failures due to this issue and need it resolved ASAP. To recap: • Org ID: c72786ec-d64f-4f80-a79a-c47f504a73c2 • Credential ID: 8516b872-087a-48ee-a1b0-c75c91413fe0 • Phone Number ID: 57ac14e5-e307-4ef4-b441-f9383a5a2794 • Trusted peer IP: 207.182.145.2 Please let us know as soon as it's done.
Hi Matt! Thanks for the quick response. Yes, the INVITE is hitting sip.vapi.ai on port 5060 UDP with the full DID in the Request-URI: INVITE sip:526627760699@sip.vapi.ai:5060 SIP/2.0 The carrier (Sippy Softswitch) sends it from 207.182.145.2:5060. Vapi responds 401, then the carrier retries directly to the resolved IP 44.238.177.138:5060 (same Request-URI user 526627760699) and Vapi responds 200 OK but sends a BYE after ~1.5 seconds. So the INVITE format is correct — the issue is purely the 401 on the FQDN and the premature BYE on the IP retry. Please go ahead and set that backend flag for our org. org ID: c72786ec-d64f-4f80-a79a-c47f504a73c2 Credential ID: 8516b872-087a-48ee-a1b0-c75c91413fe0 Phone Number ID: 57ac14e5-e307-4ef4-b441-f9383a5a2794 Trusted peer IP: 207.182.145.2
c
If inbound routing is configured, call your phone number from an external line. Ensure your provider forwards calls to the correct SIP URI:
{phoneNumber}@<credential_id>.sip.vapi.ai