SIP credentials: connect your own desk phone, and see the password again
SIP credentials are now minted by the registrar and provisioned before the API responds. Passwords can be revealed again, plus five new MCP tools.
You can point your own SIP equipment — a desk phone, an office PBX, Odoo, a softphone — at a Sautikit number, and the credential flow around it has changed in four ways worth knowing.
Creating a SIP credential now provisions it on the registrar and only then returns. A 201 means the credential already exists there and is ready to register.
Previously Sautikit generated the credential and pushed it to the registrar in the background, which left a window where you could hold a password the registrar had not yet heard of. That window is gone.
The trade is that a registrar outage now fails the request outright, with numbers.sip_provisioning_failed and nothing created. We would rather return an error than a password that will not work.
{
"username": "ep3f9a1c2b4d5e6f7a8b9c",
"password": "…",
"host": "sip.sautikit.com",
"port": 5080,
"transport": "udp",
"realm": "sip.sautikit.com"
}transport and realm are new. Both were previously absent, which left you guessing two of the five settings a desk phone needs. Read them from the response rather than hard-coding — they come from the registrar, so they cannot drift from what it actually listens on.
curl -X POST "https://api.sautikit.com/v1/numbers/{id}/sip-credentials/{cred_id}/reveal" \
-H "Authorization: Bearer $SAUTIKIT_API_KEY"The registrar owns the secret and returns it on request, so a mislaid password no longer means rotating a working credential. Revealing changes nothing — a registered device keeps working straight through the call.
Rotation is still there for when you actually want a new password, and it still disconnects the device using the old one.
Several credentials per number was always the intent — one per device, each with its own password and lifecycle. The list response now reports active_count and limit so you can see the allowance before you hit it, and creating past it returns numbers.credential_limit_reached. Revoking frees a slot.
list_sip_credentials, create_sip_credential, reveal_sip_credential, rotate_sip_credential and revoke_sip_credential are available on the hosted MCP server, so an AI client can provision a desk phone for you. reveal requires a write-scoped key, since it returns a live secret.