IP vs Credential Auth

Choose between IP allowlist and SIP digest credentials for an Edesy termination trunk, and what each mode needs on your PBX or voice-agent platform.

3 min read

Every Edesy termination trunk uses one of two authentication modes. IP allowlist trusts calls from the IPs or CIDR ranges you list, with no per-call password. SIP credentials use a username and password (SIP digest), so they work when your egress IP changes. Choose IP allowlist for fixed servers and credentials for cloud platforms or dynamic IPs.

Compare the modes#

IP allowlist SIP credentials
auth_mode value ip_allowlist credentials
How Edesy identifies you Source IP of the INVITE matches an allowed IP or CIDR Digest challenge with your username and password
Best for PBXs and servers with static public IPs; platforms that publish fixed egress IPs Platforms with dynamic egress IPs; PBXs that register
Registration Not used Supported. A PBX can register so inbound calls reach it.
What you configure Your egress IPs on the Edesy trunk Username and password on your PBX or platform
Change later Edit the allowlist from the trunk page or PATCH/v1/trunks/:id Rotate the password at any time

IP allowlist#

  1. Collect the public IPs your platform sends SIP from. Check your provider's docs or ask their support.
  2. Enter them on the trunk, one per line or comma-separated. Use CIDR notation for ranges, such as 198.51.100.0/24. A bare IP becomes /32 (IPv4) or /128 (IPv6).
  3. Leave the username and password empty on your platform.

To update the list with the API:

curl -X PATCH https://voice-api.edesy.in/v1/trunks/TRUNK_ID \
  -H "Authorization: Bearer sk_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"allowed_ips": ["203.0.113.7", "203.0.113.8"]}'

allowed_ips replaces the whole list, so send every IP you want to keep.

SIP credentials#

  1. Create the trunk with auth_mode set to credentials. Edesy generates a username and a long random password, or you can supply your own (username 4-64 characters; password 16-128 characters with at least one letter and one digit).
  2. Copy both into your platform's outbound trunk settings.
  3. For a PBX, enable registration (FreePBX: Registration: Send, Authentication: Outbound) so Edesy knows where to deliver inbound calls. The trunk page shows Registered once it succeeds.

The password is stored hashed and encrypted. You can reveal or rotate it later.

Which one should I pick?#

  • FreePBX or Asterisk on a fixed IP: either. Credentials with registration is easiest when the PBX is behind NAT.
  • LiveKit Cloud, Vapi, Retell, Bolna: credentials, unless the platform gives you a fixed list of egress IPs.
  • Dograh Cloud: IP allowlist, using the origin IP Dograh shows for your region. See the Dograh guide.

FAQ#

Can I use both modes on one trunk?#

No. A trunk has one mode. Create a second trunk if two systems need different modes.

Can I switch an existing trunk from IP allowlist to credentials?#

Create a new trunk with the mode you want, move your platform to it, then delete the old one.

Do I need to open my firewall for Edesy?#

Yes, if you receive inbound calls or registration replies. Allow SIP and media from the Edesy signalling IP shown in your trunk's FreePBX snippet. See One-Way Audio and NAT.

Why does my credentials trunk get 401 on every call?#

A 401 is the normal digest challenge. Your platform should resend the INVITE with credentials. If it keeps failing, check the username and password, and that the auth realm or domain is the trunk host.

Was this page helpful?