https://vapi.ai/ logo
Join Discord
Powered by
BYO SIP Trunk - Outbound SIP 401
# support
h
Hey team, we have a bug with outboundAuthenticationPlan on a BYO SIP trunk. PCAP confirms Vapi receives the 401 challenge from our SIP provider but instead of re-sending the INVITE with credentials it tries the next gateway without any Authorization header. The outboundAuthenticationPlan is being completely ignored. Credential ID: 862d554b-f61c-4862-820e-9bc2980d239b. Already in email thread with Priyanshu. Can someone from engineering look at this urgently?
v
To help engineering diagnose the outboundAuthenticationPlan issue, please gather and share the following with Vapi support: - Your organization ID - The exact error message received - The full request payload (redact the password) - SIP provider name and server address - Whether you are setting up for inbound, outbound, or both Example payload (redact sensitive info):
Copy code
json
{
  "provider": "byo-sip-trunk",
  "name": "My SIP Trunk",
  "gateways": [{ "ip": "203.0.113.10", "outboundEnabled": true, "inboundEnabled": false }],
  "outboundAuthenticationPlan": { "authUsername": "YOUR_SIP_USERNAME", "authPassword": "REDACTED" }
}
This will ensure engineering has all the details needed to troubleshoot effectively. (Reference: Vapi documentation on [troubleshooting SIP trunk credential errors](https://docs.vapi.ai/advanced/sip/troubleshoot-sip-trunk-credential-errors)) Source: - [Troubleshoot SIP trunk credential errors](https://docs.vapi.ai/advanced/sip/troubleshoot-sip-trunk-credential-errors)
h
Org ID: caabc376-adca-4b47-b169-dff25707aaed Error: call.in-progress.error-sip-outbound-call-failed-to-connect / SIP 401 Unauthorized SIP provider: DIDWW, outbound server: 46.19.210.19 (fra.eu.out.didww.com), port 5060, UDP Setup: outbound only Full credential payload: json{ "provider": "byo-sip-trunk", "name": "DIDWW", "gateways": [ { "ip": "46.19.210.19", "port": 5060, "outboundEnabled": true, "inboundEnabled": false }, { "ip": "46.19.209.44", "port": 5060, "outboundEnabled": true, "inboundEnabled": false } ], "outboundAuthenticationPlan": { "authUsername": "qn4HR4xMN6JPX8cp", "authPassword": "REDACTED" }, "outboundLeadingPlusEnabled": true } PCAP analysis confirms: Vapi receives the 401 challenge from DIDWW with WWW-Authenticate realm "out.didww.com" but does NOT respond with an authenticated INVITE. Instead it tries the second gateway without any Authorization header. The outboundAuthenticationPlan credentials are never used in the SIP exchange.
c
HI can you please also share your call id and the PCAP file you referring
h
Call ID: 019e64ef-c073-7773-adfc-84e30ea7231a SBC Call ID: c049d6b8-d3bb-123f-e986-0eae0358ed83 PCAP file is attached (export_c049d6b8-d3bb-123f-e986-0eae0358ed83.pcap) Summary of what the PCAP shows: Vapi sends INVITE to 46.19.210.19, DIDWW responds with 100 Trying then 401 Unauthorized with WWW-Authenticate realm "out.didww.com". Vapi ACKs the 401 but then sends a new INVITE to the second gateway 46.19.209.44 WITHOUT an Authorization header instead of re-sending to the same gateway with credentials. Same 401 happens again and Vapi gives up. The outboundAuthenticationPlan credentials are never used. https://cdn.discordapp.com/attachments/1509287752901066946/1509301934371246151/export_c049d6b8-d3bb-123f-e986-0eae0358ed83.pcap?ex=6a195736&is=6a1805b6&hm=1f0b6daf88f57969daa788699be73168970abbfdbcb87ae831f8ba83e045152f&
c
I am looking into to, will keep you updated. Thank you
In the meantime I investigate please be noted: 1- The (Inbound) failures are mostly because wrong creds. the connection should be via: correct SIP URI--->{phoneNumber}@.[sip.vapi.ai](http://sip.vapi.ai) ref: [https://docs.vapi.ai/advanced/sip/sip-trunk](https://docs.vapi.ai/advanced/sip/sip-trunk) 2- Check what is configure here: ā€¢ if outbound/inbound both checked -- issue ā€¢ if outbound checked and domain name or ip address is given--- no issue ā€¢ if inbound checked and domain name is give --issue https://cdn.discordapp.com/attachments/1509287752901066946/1509345871442084041/image.png?ex=6a18d762&is=6a1785e2&hm=b007f9bc83b86f70694338262ab06384693af16582985d17d30b688f60ebd42b&
h
Both gateways are set to Outbound Only as you can see in the screenshot. Authentication username is set. The issue remains that when DIDWW sends the 401 challenge, Vapi does not respond with an authenticated re-INVITE. The outboundAuthenticationPlan credentials are never used in the SIP exchange. https://cdn.discordapp.com/attachments/1509287752901066946/1509351546285199392/image.png?ex=6a18dcab&is=6a178b2b&hm=98d5be5be59e3b3e5cd9c36c772304cbedb61fa2423173353e1b8fe309b904e3&
Hi team, just checking in. It's been a few hours since you mentioned you were working on this. Any update? This is blocking our production system and we have a client deadline. Appreciate any progress you can share.
@User Please help me with an update
Note: we can see that outboundAuthenticationPlan works correctly with other SIP providers like didlogic. The issue appears to be specific to how Vapi handles DIDWW's 401 challenge. DIDWW uses realm "out.didww.com" with qop="auth" and algorithm=MD5. Please check if there is a compatibility issue with this specific challenge format.
@User Hi team, I want to start by apologising if my multiple messages have come across as spamming. That was never my intention. I am just a developer trying to deliver a project to my client and I am genuinely stuck. I have been working on this for days now. We have done everything right on our end, gathered PCAP evidence, worked with DIDWW support, and narrowed the issue down to a specific bug in how Vapi handles the 401 authentication challenge. The outboundAuthenticationPlan credentials are simply not being used in the SIP exchange. My project deadline is in the next few hours. This is a voice companion system for elderly Italian seniors and the outbound calls are the core of everything. Without this fix, I cannot deliver. I am not asking for much. Just someone to look at the credential 862d554b-f61c-4862-820e-9bc2980d239b and confirm why the credentials are not being sent in response to the 401 challenge from DIDWW. We have the PCAP. The evidence is clear. I really appreciate your patience and I hope someone can help me before my deadline. Thank you.
u
Hey, @HarmlessOne Did you solve the issue?
c
Hi, Apologies for the delay. After reviewing the logs, I can see that authentication was never successfully completed in your configuration. As a result, the SIP endpoint is responding with a 401 Unauthorized error. To resolve this, please ensure that the appropriate authentication credentials are properly configured on your SIP trunk/provider side and match the credentials configured in Vapi. Ref: https://docs.vapi.ai/advanced/sip/sip-trunk#create-a-sip-trunk-credential-in-vapi
h
Hi Oshi, thank you for responding. We have PCAP evidence that shows Vapi is NOT sending any Authorization header in response to the 401 challenge. It is not a credentials mismatch, Vapi is simply not attempting authentication at all. The flow is: 1. Vapi sends INVITE to DIDWW 2. DIDWW responds with 401 + WWW-Authenticate 3. Vapi ACKs the 401 4 Vapi sends a new INVITE WITHOUT any Authorization header 5. Gets 401 again and gives up The outboundAuthenticationPlan credentials are configured correctly in Vapi but are never used in the SIP exchange. We shared the PCAP file earlier in this thread. Can you look at it?
Not at all
We regenerated the DIDWW credentials and updated them in Vapi. Still getting 401. This confirms the issue is not wrong credentials. Vapi is simply not sending any Authorization header in response to the 401 challenge at all. Please look at the PCAP we shared earlier. The SIP exchange clearly shows Vapi does not attempt digest authentication.
c
Hi, can you please share the PCAP file you are referring
h
c
Can you please share your latest cred id
s
Also @HarmlessOne please confirm if you have added outboundAuthenticationPlan in your credentials. https://docs.vapi.ai/advanced/sip/sip-trunk
h
The latest credential ID is 862d554b-f61c-4862-820e-9bc2980d239b
Yes, outboundAuthenticationPlan is configured with authUsername and authPassword. We even regenerated the DIDWW credentials and updated them in Vapi but it sends the second INVITE without any Authorization header. The credentials are never used.
s
hey, i have checked your credential in our system, but there's no authentication plan configured.
Is it possible to send SS here of your BYO credential?
something might be missconfigured.
h
Here is the screenshot of the credential. We have been setting outboundAuthenticationPlan via the API and it returns success with authUsername visible. Could there be a disconnect between the API and what your system actually stores? https://cdn.discordapp.com/attachments/1509287752901066946/1512556744432292131/image.png?ex=6a2485bd&is=6a23343d&hm=a8e1c84fffbb82c0e9db47749571cb7cffdde5e2c4f20fb31606648e80958a15&
s
I can confirm that the credential shared is missing the authentication plan.
There should not be missmatch between API and creds
Can we hop on a a 15 min call? Wanna check if we everything is correctly configured.
h
Yes
s
Available now?
h
Yes I am
s
Sharing link
Joining? @HarmlessOne
h
i can not see the link you said you would share
s
Check Dm please.
Resolved this in meet. @Oshi Raghav You can close this one.
PreviousNext
Powered by