What Is a SIP Account? Username, Auth ID, Domain and Password

A SIP account is the identity and set of credentials a SIP client uses to register with a SIP server and place calls through it. At minimum it contains a username, a password and a domain. The username and domain together form your SIP address, such as sip:1001@pbx.example.com. The password proves to the server that you own that address. Many setups add a server address when it differs from the domain, an authentication ID when it differs from the username, and an outbound proxy when calls must pass through a specific host. This guide explains each field and where its value comes from.

What fields make up a SIP account?

Different softphones and providers use different labels for the same fields. The table maps the common names.

Field	Other names	What it is
Username	User, Extension, SIP ID	The user part of your SIP address
Password	Secret, SIP password	The shared secret used in digest authentication
Domain	SIP domain, sometimes labelled Realm	The host part of your SIP address
Server	Registrar, SIP server, Host	The address the client sends REGISTER requests to
Auth username	Auth ID, Authentication name	The identity sent in the authentication response
Outbound proxy	Proxy, Edge server	A host that all SIP requests are routed through
Display name	Caller ID name	The human-readable name shown to the other party

What is the SIP username?

The username is the user part of your SIP address. RFC 3261 defines a SIP URI as sip:user@host, following the generic URI syntax of RFC 3986. On an office PBX the username is almost always the extension number, such as 1001 or 2345. Hosted providers sometimes use a longer account identifier or a phone number instead.

The username appears in the From header of every request you send and in the To header of every request addressed to you. The server uses it to look up your account and to decide which calls to route to you.

What is the SIP password?

The password is a shared secret that both the client and the server know. The client never sends it in plain text. Instead, SIP uses HTTP-style digest authentication. The server replies to a request with 401 Unauthorized or 407 Proxy Authentication Required and includes a nonce. The client hashes the username, realm, password, nonce and request details together and sends back the hash. The server computes the same hash and compares. A wrong password produces another 401 or 407, or a 403 Forbidden, depending on the server.

Because the hash protects the password, a plain UDP registration does not expose it directly. It does expose everything else in the message, and the hash can be attacked offline with a weak password. Use long random passwords and TLS where possible. See SIP over UDP, TCP and TLS.

What is the SIP domain?

The domain is the host part of your SIP address. If your address is sip:1001@pbx.example.com, the domain is pbx.example.com. The server checks that the domain in the request matches one it is responsible for. Most PBXs accept their own hostname or IP address as the domain. Hosted providers often use a dedicated SIP domain that is different from the actual server you connect to, which is why softphones offer a separate domain field. Some setup sheets call this value the realm, because many servers use the domain as their authentication realm. Strictly, the realm is the name the server sends in its 401 or 407 challenge, and it can differ from the domain.

If you were given only a server address and no domain, use the server address as the domain. Most clients do this automatically when the domain field is left blank.

What is the server address, and how does it differ from the domain?

The server, also called the registrar, is the host the client sends its REGISTER request to. In a simple setup it is identical to the domain. In a larger deployment the domain is a logical name such as sip.provider.com and the actual servers are found through DNS. RFC 3263 describes how a client looks up NAPTR and SRV records for the domain to find the host, port and transport. A client that implements this only needs the domain. A client that does not, or a setup without SRV records, needs the server address entered explicitly, optionally with a port such as pbx.example.com:5080.

Asterisk-based systems such as Issabel often listen on UDP 5060 for the older chan_sip driver and may use a different port for PJSIP. Check the PBX configuration rather than assuming 5060. See Common SIP ports.

What is the auth username, and when do you need it?

The auth username is the identity the client sends inside the digest authentication response. On most PBXs it equals the username, and the field can be left blank. Some providers separate the two so that the public identity in the From header differs from the private account identity used to log in. In that case the provider supplies both, and both must be entered. A mismatch produces repeated 401 or 403 responses even though the password is correct.

What is an outbound proxy?

An outbound proxy is a host that the client sends every request to, regardless of the domain in the request URI. Providers use it to route all traffic through an edge server, a session border controller or a NAT traversal gateway. If the provider lists a proxy address, enter it in the outbound proxy field. If none is listed, leave it blank. Setting an outbound proxy unnecessarily causes requests to go to the wrong place and fail.

What does the display name do?

The display name is free text shown to the other party as the caller name. It appears in quotes before your SIP URI in the From header, for example "Alice Example" <sip:1001@pbx.example.com>. The server may override it with the name configured on your extension, so it does not always appear as entered.

How do these fields look in a softphone?

Most softphones show a short form with the server, username and password, and hide the other fields under an advanced section. In SIPdia, for example, the account page has fields labelled Server, Transport, Username, Password and Display name, with Domain, Outbound proxy, Auth username, STUN server, ICE and Encrypt audio under Advanced. A green dot indicates a successful registration. Other clients use similar layouts with slightly different labels.

How do you check that the account details are right?

1. Confirm the server address and port with the administrator or provider. Try the SIP URI generator to see the resulting address.
2. Check that the transport matches what the server expects. A server listening only on UDP will not answer TCP.
3. Make sure the username is exactly the extension or account ID, with no spaces.
4. Enter the auth username only if the provider gave one.
5. Watch the response. A repeated 401 or a 403 means the server was reached but rejected the credentials. A timeout means it was not reached. SIP registration explained covers what each response means.

Next steps

If you run more than one extension or provider, see how multiple SIP accounts work in a single app. Then read SIP registration explained to understand what happens when the account signs in.