SIP 401 and 407 Authentication Errors: Causes and Fixes

What the codes mean (general SIP)

401 Unauthorized and 407 Proxy Authentication Required are digest-authentication challenges. A single 401/407 followed by a second request carrying an Authorization or Proxy-Authorization header is normal: the server issues a nonce, the client answers with a hash of its credentials, and the call or registration proceeds.

It is only a problem when the challenge repeats — the client resends with credentials and still receives 401/407, or receives 403 Forbidden after authenticating.

Common causes

• Wrong username, auth username or password (auth username and the From user are different fields on many dialers).
• Wrong realm or the dialer is authenticating against a different host than the one it sends traffic to.
• The trunk is IP-authenticated, but the dialer is sending credentials from an address that is not on the allow-list — or the reverse.
• Clock or nonce problems on very old or misconfigured SIP stacks, causing the challenge response to be rejected as stale.
• Credentials rotated on one side but not updated in every dialer server or carrier entry.

How to diagnose

• Capture the SIP exchange (sngrep, tcpdump or your dialer's SIP debug) for one failing call.
• Check that the second request actually contains an Authorization header — if it does not, the dialer never tried credentials.
• Compare the username in the Authorization header with the one you were issued, character for character.
• Confirm the destination host/port and transport (UDP/TCP/TLS) match the trunk details you were given.

At CallCenterBoost

A CallCenterBoost SIP service uses either SIP credentials or IP authentication, confirmed during provisioning. Credential-based services let the customer reveal the stored password in the client portal; it is never sent over chat or a public form. If you believe credentials were exposed, open an Account / Login or VoIP Route ticket so the credential can be rotated by the team.