When to use Credentials vs ACL (Whitelisted IPs)
0 min
Use these guidelines to decide whether you should configure credentials, ACL (whitelisted IPs), or both on a trunk.
Credentials (SIP Digest) — recommended for Voice AI direct trunking
Use credentials when your SIP endpoint is a cloud Voice AI platform (or any environment where source IPs are dynamic/unknown), and you want to avoid managing IP allowlists.
- Best for: Voice AI direct trunking, dynamic SBCs, multi-tenant provider networks.
- Typical choice: Credentials-only (skip ACL whitelisting) when IPs are not stable.
- Recommended in case of Elevenlabs, Livekit, Retell etc SIP trunking setups
ACL (Whitelisted IPs) — recommended for static enterprise PBX/SBC
Use ACL-only when your trunk connects to a customer-controlled PBX/SBC with stable, known egress IPs.
- Best for: On‑prem SBCs, fixed datacenter IPs, tightly controlled networks.
- Typical choice: ACL-only if credentials are not required and IPs are stable.
Combination (ACL + Credentials) — highest security when IPs are stable
Use both when you have credentials and stable IPs and want a stricter security posture.
- Best for: Production trunks with fixed IP ranges and stricter access controls.
- Why: Reduces blast radius—credentials alone aren’t sufficient without also matching the allowlist (and vice‑versa).