Vapi SIP Direct - 403 Invalid credentials on every INVITE
Calls from our Saudi number (+966112501341) route through our on-prem PBX
(Grandstream UCM6302) to Vapi SIP Direct but Vapi rejects every call with 403
Forbidden / X-Reason: Invalid credentials.
Setup:
- Vapi phone number: +966112501341 (type: Vapi)
- Inbound SIP URL: sip:966112501341@sip.vapi.ai
- Assistant linked in dashboard: Noora v6 - Naqel Express
- PBX external IP: 2.88.144.75
What happens (confirmed via packet capture):
1. UCM sends INVITE sip:966112501341@sip.vapi.ai
2. Vapi replies 401 Unauthorized with Digest challenge
3. UCM retries with Authorization: Digest username="966112501341"
4. Vapi replies 403 Forbidden, X-Reason: Invalid credentials
Call-ID: 9d124382-904b-4887-89d3-55c3ad054c8f
Timestamp: 2026-05-22 19:34:31
Tried so far:
- Public API key as password -> 403
- No SIP credential fields visible on the phone number in dashboard
Questions:
1. What are the correct SIP credentials for a Vapi-type number?
2. Can you IP-allowlist 2.88.144.75 so digest auth isn't needed?
3. Should inbound calls to sip.vapi.ai even require auth, or is something
misconfigured on our number?