> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.vapi.ai/llms.txt.
> For full documentation content, see https://docs.vapi.ai/llms-full.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.vapi.ai/_mcp/server.

# Troubleshoot SIP trunk credential errors

## Overview

This guide helps you resolve the `Couldn't validate SIP trunk credential. SIP gateway creation failed.` error when creating a BYO SIP trunk credential in Vapi.

This error occurs during the gateway creation step of SIP trunk provisioning. Vapi's SBC (Session Border Controller) rejects the gateway configuration you provided. The sections below cover the most common causes and how to fix each one.

**In this guide, you'll learn to:**

* Identify the three most common causes of SIP trunk credential validation failures
* Understand when hostnames work (outbound) and when they don't (inbound)
* Resolve hostname-vs-IP, inbound-flag, and IP-allowlist issues
* Verify your gateway configuration against the full parameter reference

This guide focuses on the specific `SIP gateway creation failed` error. For
general SIP trunk setup instructions, see the
[SIP trunking](/advanced/sip/sip-trunk) page.

## Prerequisites

Before you start troubleshooting, ensure you have:

* A Vapi account with API access
* Your SIP provider's server address, username, and password
* Access to your SIP provider's admin panel (to check IP whitelisting)

## Using a hostname for an inbound gateway

This is the most common cause of this error.

### What happens

The `gateways[].ip` field accepts both hostnames (for example, `sip.example.com`) and IPv4 addresses (for example, `203.0.113.10`). However, the behavior differs depending on the call direction:

* **Outbound gateways** — Hostnames and IPv4 addresses both work. Vapi resolves the hostname when routing outbound calls to your SIP provider.
* **Inbound gateways** — Only IPv4 addresses work. The SBC needs a numeric IP address to match incoming SIP requests to your trunk. When you provide a hostname with `inboundEnabled: true`, the SBC rejects the gateway configuration.

### How to check

Look at your gateway configuration. If `inboundEnabled` is `true` (or omitted, since it defaults to `true`) and the `ip` field contains a hostname (for example, `sip.example.com`), this is the cause of the error.

### How to fix

You have two options depending on whether you need inbound calling:

**If you need inbound calling**, resolve the hostname to its IPv4 address:

Run one of the following commands to resolve your SIP provider's hostname to an IPv4 address:

```bash title="Terminal"
dig +short sip.example.com A
```

```bash title="Terminal (alternative)"
nslookup sip.example.com
```

This returns one or more IPv4 addresses, for example `203.0.113.10`.

Replace the hostname with the numeric IPv4 address in your gateway configuration:

```json title="Gateway configuration"
{
  "provider": "byo-sip-trunk",
  "name": "my sip trunk",
  "gateways": [
    {
      "ip": "203.0.113.10",
      "port": 5060,
      "outboundEnabled": true,
      "inboundEnabled": true
    }
  ]
}
```

If your provider's IP address changes, you need to update the gateway
configuration with the new address.

**If you only need outbound calling**, you can keep the hostname and disable inbound:

```json title="Gateway configuration"
{
  "provider": "byo-sip-trunk",
  "name": "my sip trunk",
  "gateways": [
    {
      "ip": "sip.example.com",
      "port": 5060,
      "outboundEnabled": true,
      "inboundEnabled": false
    }
  ]
}
```

## Inbound enabled on an outbound-only trunk

### What happens

The `inboundEnabled` gateway option defaults to `true`. If your SIP trunk is outbound-only (you only make calls through it, you do not receive inbound calls through Vapi), having inbound enabled can cause gateway creation to fail with some providers.

### How to check

Look at your API request. If you did not set `inboundEnabled` explicitly, it defaulted to `true`. If you only need outbound calling, this is likely the problem.

### How to fix

Set `inboundEnabled` to `false` in your gateway configuration:

```json title="Gateway configuration"
{
  "provider": "byo-sip-trunk",
  "name": "my sip trunk",
  "gateways": [
    {
      "ip": "203.0.113.10",
      "port": 5060,
      "outboundEnabled": true,
      "inboundEnabled": false
    }
  ]
}
```

If you are using the Vapi dashboard, uncheck the **Inbound** option when
configuring the gateway.

## Carrier IP allowlist not configured

### What happens

Your SIP provider needs to allow traffic from Vapi's SBC IP addresses. If these IPs are not on the allowlist, the SBC's registration and signaling requests to your provider are blocked, and gateway creation fails.

### How to check

Ask your SIP provider whether the following IP addresses are on their allowlist:

* `44.229.228.186/32`
* `44.238.177.138/32`

### How to fix

Ask your SIP provider to add both Vapi SBC IP addresses to their allowlist:

| IP address       | Netmask |
| ---------------- | ------- |
| `44.229.228.186` | `/32`   |
| `44.238.177.138` | `/32`   |

Both addresses must be allowed. Vapi may use either one for signaling, so
missing one can cause intermittent failures.

## Gateway configuration reference

The table below lists all available options for each entry in the `gateways` array.

| Option               | Type    | Default    | Description                                                                                                                               |
| -------------------- | ------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `ip`                 | string  | (required) | IPv4 address or hostname of your SIP gateway. Hostnames work for outbound-only gateways. Inbound gateways require a numeric IPv4 address. |
| `port`               | number  | `5060`     | SIP signaling port.                                                                                                                       |
| `netmask`            | number  | `32`       | Subnet mask for inbound IP matching. Valid range: 24 to 32.                                                                               |
| `inboundEnabled`     | boolean | `true`     | Whether this gateway accepts inbound calls. Set to `false` for outbound-only trunks.                                                      |
| `outboundEnabled`    | boolean | `true`     | Whether outbound calls route through this gateway.                                                                                        |
| `outboundProtocol`   | string  | `"udp"`    | Signaling protocol. Options: `udp`, `tcp`, `tls`, `tls/srtp`.                                                                             |
| `optionsPingEnabled` | boolean | `false`    | Whether to send SIP OPTIONS pings to check if the gateway is reachable.                                                                   |

## If the error persists

If none of the above resolves your issue, gather the following information and contact Vapi support:

* Your organization ID
* The exact error message you received
* The full request payload you sent (redact the password)
* Your SIP provider name and server address
* Whether you are setting up for inbound calls, outbound calls, or both

## Next steps

Now that you can troubleshoot SIP trunk credential errors:

* **Review SIP trunk setup:** Follow the complete [SIP trunking](/advanced/sip/sip-trunk) guide to verify your configuration end-to-end
* **Configure a provider:** Set up your SIP trunk with a specific provider such as [Twilio](/advanced/sip/sip-twilio), [Telnyx](/advanced/sip/sip-telnyx), [Zadarma](/advanced/sip/sip-zadarma), or [Plivo](/advanced/sip/sip-plivo)
* **Learn about SIP telephony:** Explore the [SIP telephony](/advanced/sip/sip) overview for broader SIP integration options