Auth Username
The auth username is the identity a SIP client presents during digest authentication. It can differ from the extension number, which improves security on PBXs that support it.
Published 8 November 2026 · 1 min read · By SpaGreen Creative
Short answer
The auth username is the name a SIP client sends in the Authorization header during digest authentication, which may differ from the user part of its SIP address.
When a SIP server challenges a request with 401 Unauthorized, the client answers with an Authorization header that contains a username, the realm, a nonce and a hash computed from the password. The username in that header is the auth username. RFC 3261 section 22 adopts HTTP digest authentication for this purpose.
In the simplest setup the auth username equals the user part of the SIP address, so extension 201 authenticates as 201. Many PBX systems, including Asterisk and the distributions built on it, allow the two to differ. Extension 201 might authenticate as k7x2m9pq. Because extension numbers are easy to guess from a company directory, a separate auth username removes one of the two values an attacker needs.
Providers also use this split when the SIP address is a phone number but the login name is an account identifier.
In SIPdia the Username field holds the extension or account name that forms your SIP address, and the Auth username field in the Advanced section holds the authentication name. Leave Auth username empty when both are the same. A persistent 401 after entering the correct password is often a sign that the auth username is wrong.
Sources and further reading
- RFC 3261: SIP: Session Initiation Protocol, Section 22 Usage of HTTP Authenticationwww.rfc-editor.org
- RFC 7616: HTTP Digest Access Authenticationwww.rfc-editor.org
This article is published by SpaGreen Creative, the maker of SIPdia. Product names mentioned belong to their owners. Where it describes other software, treat the steps as general guidance and check the official documentation linked above.
