---
title: 'SIP credentials: connect your own desk phone, and see the password again'
description: >-
  SIP credentials are now minted by the registrar and provisioned before the API
  responds. Passwords can be revealed again, plus five new MCP tools.
summary: >-
  Registrar-minted SIP credentials with synchronous provisioning, a new reveal
  endpoint, a per-number cap, and five new MCP tools.
date: 2026-08-05T00:00:00.000Z
type: changelog
---


## What's new

You can point your own SIP equipment — a desk phone, an office PBX, Odoo, a softphone — at a Sautikit number, and the credential flow around it has changed in four ways worth knowing.

## The registrar mints the credential, and does it before we answer

Creating a SIP credential now provisions it on the registrar and only then returns. A `201` means the credential already exists there and is ready to register.

Previously Sautikit generated the credential and pushed it to the registrar in the background, which left a window where you could hold a password the registrar had not yet heard of. That window is gone.

The trade is that a registrar outage now fails the request outright, with [`numbers.sip_provisioning_failed`](/developers/errors/numbers.sip_provisioning_failed) and nothing created. We would rather return an error than a password that will not work.

## The create response carries everything the device needs

```json
{
  "username": "ep3f9a1c2b4d5e6f7a8b9c",
  "password": "…",
  "host": "sip.sautikit.com",
  "port": 5080,
  "transport": "udp",
  "realm": "sip.sautikit.com"
}
```

`transport` and `realm` are new. Both were previously absent, which left you guessing two of the five settings a desk phone needs. Read them from the response rather than hard-coding — they come from the registrar, so they cannot drift from what it actually listens on.

## Passwords can be shown again

```bash
curl -X POST "https://api.sautikit.com/v1/numbers/{id}/sip-credentials/{cred_id}/reveal" \
  -H "Authorization: Bearer $SAUTIKIT_API_KEY"
```

The registrar owns the secret and returns it on request, so a mislaid password no longer means rotating a working credential. Revealing changes nothing — a registered device keeps working straight through the call.

Rotation is still there for when you actually want a new password, and it still disconnects the device using the old one.

## One credential per device, up to a limit

Several credentials per number was always the intent — one per device, each with its own password and lifecycle. The list response now reports `active_count` and `limit` so you can see the allowance before you hit it, and creating past it returns [`numbers.credential_limit_reached`](/developers/errors/numbers.credential_limit_reached). Revoking frees a slot.

## Five new MCP tools

`list_sip_credentials`, `create_sip_credential`, `reveal_sip_credential`, `rotate_sip_credential` and `revoke_sip_credential` are available on the [hosted MCP server](/developers/guides/connect-mcp), so an AI client can provision a desk phone for you. `reveal` requires a write-scoped key, since it returns a live secret.

## Where to read more

- [Numbers concepts — SIP credentials](/developers/concepts/numbers)
- [Rotating SIP credentials without dropping a call](/blog/2026-07-04-sip-credential-rotation)