SIP 401 Unauthorized

What SIP 401 means

A 401 asks the client to prove who it is. The response carries a WWW-Authenticate header with a realm and a nonce, and the client is expected to send the same request again with an Authorization header computed from its username and password. Registrars and far-end user agents send 401; a proxy sends 407 instead.

Seeing 401 once is normal. Most REGISTER requests, and many INVITEs on a trunk that uses credentials, get a 401 first and succeed on the retry. It only becomes a problem when the retry is challenged again or refused with 403, which means the credentials, the realm or the username format are wrong.

Example response

SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 198.51.100.16:5060;branch=z9hG4bK-401-h8
From: <sip:[email protected]>;tag=19b4
To: <sip:[email protected]>;tag=reg-882
Call-ID: [email protected]
CSeq: 1 REGISTER
WWW-Authenticate: Digest realm="example.net", nonce="5f3c9a1e7b", algorithm=MD5, qop="auth"
Content-Length: 0

Common causes of SIP 401

• The client sent its first request without credentials, which is the normal start of a digest exchange.
• The username or password configured on the trunk doesn't match the provider's records.
• The client answers with credentials for a different realm than the one in the challenge.
• The nonce went stale between challenge and retry, and the server challenges again with stale=true.
• The server asks for a digest algorithm or qop option that the client doesn't support.

How to fix SIP 401

1. Check that the retry carries an Authorization header at all; if it doesn't, the client has no credentials for that realm.
2. Compare the realm in the challenge with the one configured on the trunk, and the username with what the provider issued.
3. Re-enter the password; a stray space, or a reset on the provider's side, is easy to miss.
4. If the server keeps challenging, compare the algorithm and qop it offers with what the client supports.
5. If the provider can authenticate by IP address instead, ask it to add yours so the trunk stops challenging.

SIP 401 as an answer to OPTIONS

A 401 to OPTIONS means the server is up and wants credentials, which is normal for an SBC or registrar. The free check reports the challenge as received and sends no second request. On a PingVo Route the agent answers one challenge with the Route's credentials and records the response to that retry; either way, any SIP response counts as reachable by default.

Questions about SIP 401

What is the difference between SIP 401 and 407?

Both are digest challenges. 401 comes from a registrar or the far-end user agent and uses WWW-Authenticate and Authorization. 407 comes from a proxy and uses Proxy-Authenticate and Proxy-Authorization.

Is a SIP 401 an error?

Only if it repeats. One 401 followed by success is the normal digest handshake. A second 401 or a 403 after the retry means the credentials were not accepted.

Why does REGISTER work but INVITE gets 401?

Registrations and calls can be authenticated separately. The trunk may need credentials on outgoing INVITEs too, or the provider may expect calls only from an allowed IP address.

Related codes