SIP 401 Unauthorized

What SIP 401 means

A challenge for credentials, not a failure. One 401 followed by a successful registration is how SIP authentication is meant to work. Only a repeating 401 means something is wrong, and it almost always means the SIP password or authentication username is wrong.

Client error (4xx)
Sent by Registrar, or any server challenging for credentials
Common

What SIP 401 Unauthorized actually means

The server needs to verify who you are before it will act on the request, so it rejects the first attempt and includes a WWW-Authenticate header containing a one-time value called a nonce. The phone is expected to hash its password with that nonce and send the request again. This two-step exchange happens on every registration, which is why a single 401 in a log is normal and expected.

What causes SIP 401 on a business phone system

The SIP password is wrongBy far the most common reason a 401 repeats. The phone answers the challenge, the hash does not match, and the server challenges again. Note that this is a different credential from the portal login for most providers, and copying it by hand is where the error usually creeps in.
The authentication username is not the extension numberMany platforms issue an authentication ID that differs from the extension number and from the display name. If the phone is sending the extension where the auth ID belongs, the password can be perfectly correct and still fail.
The SIP realm or domain does not matchThe digest hash covers the realm as well as the password. A phone provisioned with the wrong SIP domain computes a hash the server cannot reproduce, which looks identical to a bad password from the log.
The handset clock is badly wrongSome platforms expire a nonce on a time window. A phone with no working NTP server after a power cut can drift far enough that every nonce it receives is already stale by the time it replies.

How to fix SIP 401

Re-enter the SIP password by hand rather than pasting itRetype it in the handset or provisioning template, watching for a trailing space and for characters that are easy to confuse such as l, 1, I, O and 0. Reset the password in your provider portal if you cannot see it.
Check the authentication ID against the extension numberIn your provider portal, find the extension and compare its authentication or SIP username against what the phone is sending. Where they differ, the phone must use the authentication ID.
Confirm the SIP domain and outbound proxyThese must match your provider exactly, including any regional prefix. A phone moved between providers often keeps the old domain.
Set a working NTP server and reboot the handsetOnce the clock is right, a handset that had been looping on 401 usually registers on the next attempt.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SIP 401

Is a SIP 401 an error?

Not on its own. SIP authentication is deliberately a two-step exchange: the server challenges with a 401, the phone answers with a hashed password, and the registration succeeds. You will see a 401 for every registration on a perfectly healthy system. It is only a fault when the same extension is challenged over and over without ever registering.

What is the difference between SIP 401 and SIP 407?

They ask the same question from different places. A 401 comes from the server that owns your account, typically the registrar, and is what you see when a phone registers. A 407 comes from a proxy sitting in the path and is what you usually see on an outbound call. The fix is the same in both cases: give the device the right credentials for the right realm.

Why does my phone show 401 after I changed provider?

Because the SIP domain almost certainly still points at the old provider. The digest hash covers the realm as well as the password, so a phone that authenticates against the wrong domain fails in a way that looks exactly like a wrong password. Check the SIP server, outbound proxy and realm fields before you touch the password.

Related SIP response codes

Source. SIP 401 Unauthorized is defined in RFC 3261 section 21.4.2 and registered in the IANA SIP Parameters — Response Codes. The causes and fixes above are drawn from our own experience supporting UK business phone systems.

All VoIP & SIP codes