I want to use basic auth on the inbound sip trunk in LiveKit. How can I do that?

Thanks for reaching out, James. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.

When making a SIP Invite to LiveKit, how should I pass these credentials along?

Thanks — you're asking how to include the basic-auth credentials on the SIP INVITE to LiveKit. I can help; quick clarifying question first: Which SIP client, gateway, or library are you using to send the INVITE (for example: Asterisk, FreeSWITCH, Kamailio, OpenSIPS, PJSIP, sip.js, or a cloud provider)? Different stacks expose different ways to add authentication headers. General guidance (standard SIP approach) • SIP basic auth credentials are passed in the Authorization header of the SIP request. • For basic authentication you add an Authorization header with the Basic scheme and a base64-encoded string of `username:password`: ◦ Header form: Authorization: Basic base64(username:password) • Most SIP providers and SIP stacks instead use SIP Digest (Authorization: Digest ...) for REGISTER/INVITE authentication; if LiveKit expects simple basic auth on the trunk side, the above Basic header is how to send it. What I need to give exact instructions • Tell me which SIP stack/library/gateway you're using so I can show the exact configuration or code to add the Authorization header on the INVITE. • Also confirm whether your provider expects Basic (Authorization: Basic) or Digest (Authorization: Digest) authentication for the trunk — if it's Digest, the flow is different (challenge-response with a 401 from the server). If you tell me your SIP stack, I’ll provide a concrete example (configuration or code) to include the credentials on the INVITE. , with interactive elements

We're using Freeswitch and Inviting out to LiveKit

Thanks — I’m responding to your follow-up about how to include the trunk credentials on INVITEs from FreeSWITCH to LiveKit. Short answer • LiveKit expects the inbound trunk’s

auth_username

and

auth_password

to be presented on incoming SIP requests. Configure FreeSWITCH to send those credentials in the SIP Authorization header when it sends the INVITE to the LiveKit trunk. TLS is recommended to protect the credentials in transit. What to configure in FreeSWITCH 1. Define a gateway (or profile/route) toward LiveKit that includes the username and password you set on the LiveKit inbound trunk. ◦ Typical fields you set on the gateway are

username

and

password

(or `from-user`/`from-domain` depending on your dialplan/gateway config). 1. Ensure the outbound INVITE uses that gateway so FreeSWITCH will attach an Authorization header. FreeSWITCH will normally perform SIP authentication using Digest when challenged; by configuring credentials on the gateway it will automatically respond to a 401/407 challenge and include the proper

Authorization

header. Example (gateway snippet for

sofia

gateway) • In

sofia/gateway/<livekit>.xml

(or via dialplan variables), set: ◦

username="your_sip_username"

◦

password="your_sip_password"

◦

proxy="sip.livekit.example:5060"

(use the LiveKit host and port) ◦ Use

transport="tls"

if you configured LiveKit for TLS What that achieves • When FreeSWITCH sends an INVITE to LiveKit, one of these will occur: ◦ If LiveKit challenges with 401/407, FreeSWITCH responds with an

Authorization: Digest ...

header computed from the configured `username`/`password`. ◦ If LiveKit expects credentials up-front, many SIP gateways also allow prepopulating the

Authorization

header (or send a preemptive REGISTER/INVITE response) using the configured `username`/`password`. Practical notes and troubleshooting • Digest vs Basic: ◦ SIP normally uses Digest authentication (Authorization: Digest ...) via challenge/response. LiveKit trunk fields are

auth_username

and

auth_password

— FreeSWITCH will use them to compute Digest responses to a 401. ◦ If LiveKit requires a Basic Authorization header (Authorization: Basic ...), FreeSWITCH does not send Basic by default for SIP auth. Let me know if LiveKit strictly requires Basic and I’ll outline a workaround (for example, adding a custom header or manipulating the outbound INVITE). • Transport: ◦ Use TLS if possible so credentials and SIP signaling are encrypted. • Logs: ◦ If authentication fails, enable SIP trace on the appropriate FreeSWITCH Sofia profile and capture the INVITE/401/Authorization exchange to see what header LiveKit receives. • From/To headers: ◦ Ensure your

From

or

from-user

matches the

auth_username

if LiveKit expects that mapping. Some trunks validate the From header user against the configured

auth_username

. If you want, tell me: • The exact FreeSWITCH gateway/profile XML you’re using (or the Sofia gateway fields), and the LiveKit SIP host/port and whether you’re using TLS. • Whether LiveKit challenged with a 401 (so FreeSWITCH should reply with Digest) or authentication is being rejected immediately. I can then: • Show a concrete gateway XML example tailored to your setup. • Provide the exact debug commands to capture the SIP exchange and diagnose a failed auth. Sources: sip | livekit/livekit_composite | DeepWiki | Agents telephony integration | LiveKit Documentation, with interactive elements