---
title: "Create a SIP session credential"
method: POST
path: "/v1/voice/session-credentials"
tags: ["voice-trunks"]
---

# Create a SIP session credential

`POST /v1/voice/session-credentials`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/voice/session-credentials`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Issues a workspace-scoped SIP digest credential valid for five minutes. The password appears only in this response; create another credential if you lose it. Trunks must allow session credentials to accept it.

The request has no body. Each successful request creates a fresh credential, including retries. Keep retries bounded: creating more than 20 live credentials for the same caller invalidates the oldest. Treat the password as a bearer secret until expires_at.

## Headers

- `Idempotency-Key` string
- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `201`

Credential minted. The password appears only in this response.

- VoiceSessionCredential: A short-lived SIP digest credential for a calling client. The `password` is returned once and cannot be recovered. Create a new credential if you lose it.
  - `username` string, required: SIP digest username. Always `bird`. The credential identifies the workspace through `realm`. The username does not identify the workspace.
  - `password` string, required: SIP digest password, returned once. Treat it as a bearer secret: until it expires it can place calls billed to this workspace.
  - `realm` string, required: SIP digest realm to authenticate against. Workspace-scoped, so a credential minted for one workspace cannot authenticate against another.
  - `expires_at` string, date-time, required: When the credential stops authenticating, five minutes after creation. Existing calls may continue; use a fresh credential for later authentication.
  - `handshake_token` string: Short-lived token required when upgrading the WebSocket connection. The token authorizes the connection only; each call still authenticates with `password`.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)