# Rotate the Password

> Reveal or rotate the SIP password of an Edesy credentials trunk from the portal or with the API, and update your PBX without dropping calls.

Source: https://edesy.in/docs/sip-trunking/termination-trunks/rotate-password

On a credentials trunk, you can **reveal** the current SIP password (up to 5 times an hour per workspace, each one audit-logged) or **rotate** it to a new one. Rotation takes effect at once: the old password stops working immediately, so have your PBX or platform settings open before you rotate.

## Reveal the current password

1. Open the trunk page in the portal.
2. In **Authentication**, click **Reveal**.

With the API:

```bash
curl https://voice-api.edesy.in/v1/trunks/TRUNK_ID/reveal-password \
  -H "Authorization: Bearer sk_YOUR_API_KEY"
```

The response returns `sip_username` and `sip_password`. Trunks created before passwords became retrievable return `409`; rotate once to make the password revealable from then on.

## Rotate the password

1. Open the trunk page and click **Rotate** in **Authentication**.
2. Leave **New password** blank to generate a strong one, or enter your own (16-128 characters, at least one letter and one digit, no spaces).
3. Click **Rotate** and copy the new password from the dialog.
4. Paste it into your PBX or platform and save there.

With the API:

```bash
curl -X POST https://voice-api.edesy.in/v1/trunks/TRUNK_ID/rotate-password \
  -H "Authorization: Bearer sk_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
```

Send `{"new_password": "..."}` instead of `{}` to set your own. The response contains `sip_username` and the new `sip_password`; the username does not change.

## Rotate with minimal disruption

- Rotate during a quiet period. Calls in progress are not affected, but new calls with the old password fail until your platform is updated.
- A registering PBX loses its registration at the next refresh if it still has the old password. Update it straight away and check that the trunk shows **Registered** again.
- If you cannot afford any gap, create a second credentials trunk, move your platform to it, then delete the old trunk.

## FAQ

### Can Edesy staff read my password?

The password is stored hashed for authentication and encrypted for the reveal feature. Reveals are rate-limited and logged.

### I hit the reveal limit. What now?

Wait an hour, or rotate the password, which shows the new one immediately.

### Does rotating change my SIP host or username?

No. Only the password changes.