SIP 407 is the proxy equivalent of 401 Unauthorized. Instead of the registrar challenging your credentials, a SIP proxy in the call path is demanding authentication before it will forward your INVITE or REGISTER. Here's how to diagnose and fix it.
SIP 407 Proxy Authentication Required is defined in RFC 3261 Section 21.4.27. It means an intermediate SIP proxy — not the final destination — requires authentication before it will forward your request. The proxy responds with a Proxy-Authenticate header containing a digest challenge, and your UA must resend the request with a Proxy-Authorization header containing the digest response.
401 Unauthorized comes from the final destination — the registrar or UAS. It uses WWW-Authenticate in the challenge and requires Authorization in the response.
407 Proxy Authentication Required comes from an intermediate proxy. It uses Proxy-Authenticate in the challenge and requires Proxy-Authorization in the response.
A call can require both — the proxy challenges first (407), then after passing the proxy, the registrar challenges (401). Your UA must handle both independently with separate credential sets if the realm differs.
One important difference: 407 responses to INVITE must be acknowledged with an ACK, just like a 200 OK. Failure to send the ACK causes a dialog leak on the proxy.
outboundproxy with credentials. In PJSIP, configure an auth object and associate it with your endpoint or AOR.In your SIP trace, look for the challenge/response cycle:
If the second INVITE is never sent, your UA doesn't support proxy auth. If the second INVITE is sent but another 407 comes back, either the credentials are wrong or the proxy has a logic issue.
Configure proxy credentials on your UA: Most SIP phones and softphones have a separate field for outbound proxy authentication. Set the username, password, and realm to match your proxy's requirements.
Asterisk PJSIP: Create an [auth] section with auth_type=userpass and associate it with your endpoint using outbound_auth=.
FreeSWITCH: In the gateway configuration, add <param name="proxy-auth" value="true"/> and set the corresponding credentials.
If you're seeing 407 loops: Check your proxy's authentication module configuration. Verify it's not re-challenging already-authenticated requests. Enable verbose proxy logging to trace the authentication decision.
SIP 407 means an intermediate SIP proxy requires authentication before forwarding your request. Unlike 401 which comes from the registrar, 407 comes from a proxy in the call path. You must resend the request with a Proxy-Authorization header containing your proxy credentials.
SIP 401 comes from the final destination (registrar/UAS) and uses WWW-Authenticate. SIP 407 comes from an intermediate proxy and uses Proxy-Authenticate. A call can trigger both — the proxy challenges first with 407, then the registrar with 401.
In Asterisk PJSIP, create an auth object with your proxy credentials and associate it with your endpoint using outbound_auth=. In chan_sip, configure the outboundproxy with credentials. Make sure the realm in your auth configuration matches the realm in the Proxy-Authenticate challenge.
Paste your SIP trace into SIPSymposium. The analyzer identifies the proxy challenge, checks credential exchange, and tells you exactly what credentials are missing or misconfigured.