Keep Your SIP Trunk And API Credentials Secure

Your SIP trunk password and API keys are the actual keys to your account's calling and messaging capability — anyone who has them can place calls, send messages, and rack up real billing on your balance, exactly as if they were you. A few concrete habits keep that from happening.

Treat credentials like a bank password, not a username

Don't paste SIP passwords or API keys into chat messages, tickets, shared documents, or code that gets committed to a public repository. If a credential has ever been shared somewhere insecure, rotate it — don't just hope nobody saw it.

Restrict where credentials can be used from

If your traffic only ever comes from a known, fixed IP or a small set of them, lock your account down to that — an attacker with a leaked password still can't use it from an unrecognized source. This is one of the single most effective things you can do.

Rotate on staff changes

When someone with access to your SIP/API credentials leaves the team or changes role, rotate the credentials. A password that was fine to share internally in June isn't automatically still safe in December.

Watch for signs of compromise

Fraud Watch (see our related alert on toll fraud) is your safety net if credentials do leak — but the earlier you notice an unfamiliar spike yourself, the less damage is done before automated protection kicks in. Review your CDRs periodically, not only when something already looks wrong.

If you suspect a credential has been compromised, rotate it immediately from your dashboard — don't wait to confirm the suspicion first.