Authentication

Every trunk decides who is allowed to use it. You can authenticate by source IP address, by a SIP digest username and password, or by both together. Credentials and the allowlist live in the trunk's side panel.

In the app: Dashboard → Automation → Calls → Trunks → (click a trunk)

A WhatsApp call has two legs, and each leg has its own authentication. They are unrelated, and mixing them up is the most common mistake in setting this up.

Everything on this page is about the second leg. You never see, enter or manage the WhatsApp-side credential — if it drifts, calls stop and you contact support, but there is no setting for it.

Set this with the Authentication dropdown when creating or editing a trunk.

IP allowlist is the default and is fine when your phone system has a fixed public IP that you control.

Digest credential suits a phone system on a dynamic address, or a cloud platform whose egress IP you cannot pin down.

IP + credential is the strongest, and what we recommend for outbound trunks. A leaked password on its own gets an attacker nowhere, because it would also have to be used from your network.

The banner says the password is not shown again, and for a fresh credential that is the safest thing to assume. In practice the password can be recovered: click the eye icon on the credential row to reveal it, and the copy button next to it to copy.

Each credential row has:

A trunk can hold several credentials. That is how you roll a password without downtime: add a new credential, move your phone system onto it, confirm calls still work, then delete the old one.

A credential can carry an expiry date. Leave it blank — the default — and it never expires. An expired credential stops being accepted at the moment it expires, exactly as if you had switched it off.

Expiry is useful for a contractor's temporary access or a time-boxed migration. For your normal production trunk, leave it blank; a credential that expires unnoticed at 3am is an outage.

The allowlist names the networks your phone system signals from. It applies on trunks whose mode is IP allowlist or IP + credential.

Type an address or a range in the box at the bottom of the IP allowlist section and click Add.

A bare address is automatically narrowed to just itself. A range is tidied to its canonical form, so 203.0.113.7/24 is stored as 203.0.113.0/24.

Each row has a copy button, an enable switch to take a range out of use without deleting it, and a delete icon.

The range itself cannot be edited once added — if you got it wrong, delete it and add the correct one. Duplicates on the same trunk are rejected.

Add the public IP your phone system sends SIP from, not its private LAN address. If it sits behind NAT, that is your internet-facing address; if it is a cloud platform, that is the egress address your provider documents. Getting this wrong is the usual cause of a trunk that refuses every call — see Test a trunk.