Breadcrumbs

Outbound authentication

CM.com supports digest authentication and IP based authentication.

Digest authentication for outbound calling is supported with SIP INVITE and SIP REGISTER. Digest authentication using SIP INVITE is advised. CM.com does not support SIP REGISTER for inbound calling and as such, there is no benefit in using SIP REGISTER for outbound calling. Most PBX systems and clients support digest authentication.

The SIP Account username and password for digest authentication can be found in the Voice Management App when you edit the setting of your SIP Account or when you download the techform.

When IP based authentication is desired, this can be configured per SIP Account IP endpoint in the Voice Management App (link). Check the checkbox “Disable authentication”. Be advised that all calls originating from this IP address will be automatically authenticated and billed to your account.

Detailed authentication flows

SIP INVITE + digest authentication

sip_digest_auth.svg

  1. INVITE – the UAC sends the initial request with no credentials.

  2. 407 Proxy Authentication Required – the proxy rejects the INVITE, returning a Proxy-Authenticate header containing a fresh nonce, realm, and supported algorithm.

  3. ACK – the UAC acknowledges the 407 to close out that transaction.

  4. The UAC computes the digest response.

  5. New INVITE – sent with the same Call-ID and a freshCSeq (incremented) and a Proxy-Authorization header carrying the computed digest response.

  6. Assuming the credentials check out, the call proceeds normally from here (100 Trying / 180 Ringing / etc).

SIP REGISTER + digest authentication

sip_register_digest_auth_then_invite.svg


  1. REGISTER – the UAC sends an initial registration request with no credentials, just its AOR (Address of Record) and contact info.

  2. 401 Unauthorized – the CM.com SIP gateway rejects it and returns a WWW-Authenticate header containing a fresh nonce, realm, and the algorithm it expects (e.g. MD5 or SHA-256).

  3. The UAC computes the digest response.

  4. New REGISTER – sent with the same Call-ID and a freshCSeq (incremented), this time carrying an Authorizationheader with the computed digest response.

  5. 200 OK – the gateway validates the digest and confirms the registration, echoing back the Contact header with an expires value.

  6. Time passes – the registration is now active. UAC should periodically re-REGISTER before expires runs out to keep the binding alive.

  7. INVITE – later, the now-registered UAC places a call. Because it's already registered, the CM.com SIP gateway can route this without a fresh registration challenge.

  8. The call proceeds normally from here (100 Trying / 180 Ringing / etc).

IP Based authentication

sip_ip_based_auth_invite_flow.svg


  1. INVITE – the UAC sends the request with no Authorization header at all — no digest credentials are attached because none are expected.

  2. The CM.com SIP gateway checks the source IP. If the source IP matches an entry on the list, the request is implicitly trusted — no challenge is ever issued, so there's no 401/407 round trip like in digest auth.

  3. The CM.com SIP gateway immediately starts processing the call, and the call proceeds normally from here (100 Trying / 180 Ringing / etc).


FAQ

Can IP based authentication be used in shared or cloud environments?

When using a cloud environment (AWX, Google Cloud, Azure, etc) without a dedicated public IP address we strongly discourage using IP based authentication. All calls originating from the configured IP address will automatically be authenticated and billed to your account. This is similar for shared or multi-tenant systems such as cloud hosted PBX solutions. Please consider using digest authentication.

I do not get any response to my SIP REGISTER or SIP INVITE

Please ensure your public source IP is listed in the IP endpoints of the SIP Account. CM.com always performs IP address verification. Traffic from unknown IP addresses is dropped. The source port should match the configured port. Alternatively, the port can be set to 0, allowing all source ports. When using TLS for the SIP signalling, please configure the port to be 0 as the source port will be dynamic.

Why do I get a 401 Unauthorized when sending a SIP REGISTER even though I use IP based authentication?

Only one authentication method can be used. When using IP based authentication, all SIP REGISTER requests are rejected with a 401 Unauthorized. Please disable SIP REGISTER or enable digest authentication for your SIP Account.

Why can I only use IP based authentication for an IP under a single SIP Account?

When using IP based authentication, CM.com will log and bill all calls originating from that IP under the corresponding SIP Account. As such, the IP and the SIP account will be coupled 1-to-1 and we only allow the IP address to be used for a single SIP account.