---
title: When to use Credentials vs ACL (Whitelisted IPs)
slug: dynamic-sip-trunking/when-to-use-credentials-vs-acl-whitelisted-ips
createdAt: 2026-08-10T10:44:05.009Z
---

Use these guidelines to decide whether you should configure **credentials**, **ACL (whitelisted IPs)**, or **both** on a trunk.

Credentials (SIP Digest) — recommended for Voice AI direct trunking

Use **credentials** when your SIP endpoint is a **cloud Voice AI platform** (or any environment where source IPs are dynamic/unknown), and you want to **avoid managing IP allowlists**.

- **Best for**: Voice AI direct trunking, dynamic SBCs, multi-tenant provider networks.
- **Typical choice**: **Credentials-only** (skip ACL whitelisting) when IPs are not stable.
- Recommended in case of Elevenlabs, Livekit, Retell etc SIP trunking setups

ACL (Whitelisted IPs) — recommended for static enterprise PBX/SBC

Use **ACL-only** when your trunk connects to a customer-controlled PBX/SBC with **stable, known egress IPs**.

- **Best for**: On‑prem SBCs, fixed datacenter IPs, tightly controlled networks.
- **Typical choice**: **ACL-only** if credentials are not required and IPs are stable.

Combination (ACL + Credentials) — highest security when IPs are stable

Use **both** when you have credentials *and* stable IPs and want a stricter security posture.

- **Best for**: Production trunks with fixed IP ranges and stricter access controls.
- **Why**: Reduces blast radius—credentials alone aren’t sufficient without also matching the allowlist (and vice‑versa).