Session Initiation Protocol (SIP)
Updated: Nov 18, 2025 When SIP is enabled, you cannot use calling related Graph API endpoints and calling related webhooks are not sent.Overview
Session Initiation Protocol ( SIP) is a signaling protocol used for initiating, maintaining, modifying, and terminating real-time communication sessions between two or more endpoints. WhatsApp Business Calling API supports use of SIP as the signaling protocol instead of our Graph API endpoints and Webhooks.Before you get started
Before you get started with SIP call signaling, confirm the following: You meet overall calling pre-requisites Your app has messaging permissions for the business phone number you want to enable SIP for. Test this by sending and receiving messages using Graph API messaging endpoints, then use the same app to configure your SIP server on the business phone number for calling. Double confirm this by using health status API withPHONE_NUMBER_ID
Your app mode is “Live”, not “Development”.
You have a standards compliant third party SIP server that supports TLS transport and digest authentication
Signaling and media possible configurations
*Note: You can use SDES instead of ICE+DTLS with Graph API + Webhook signaling
Calling flows using SIP
Before you start, make sure you have enabled and configured SIP on the business phone number. Meta generates a unique SIP user password for each business phone number + app combination. You will need this information and can retrieve it by using the get Call Settings endpoint.Security
TLS transport is mandatory for SIP. Meta will present a valid server cert with subject name that covers our SIP domain wa.meta.vc. Your SIP server should do the same as Meta ensures your cert is valid and subject name covers SIP domain you configured on the business phone number Meta does NOT support mutual TLS (aka mTLS). This means, when Meta takes the role of a TLS client, your TLS server should not request Client certificate. If you still request client cert, Meta will present a client cert but the cert subject name would refer to a random dynamic host which will not pass certificate validation. Meta addstransport=TLS to request URI as part of it’s SIP requests to partner SIP server
For business initiated calls, SIP invite from your SIP server will be challenged using digest auth. See
business-initiated calls for more details
For user initiated calls, it is highly recommended that you challenge SIP INVITE request from Meta, to use digest auth for more security. See
user-initiated calls for more details
How to test if you have a valid TLS certificate
When a WhatsApp user calls a business, a common reason for your SIP server to not receive the SIP INVITE from Meta is the certificate validation error. You can use information here to confirm valid setup. Run the commandopenssl s_client -quiet -verify_hostname {hostname} -connect {hostname}:{port} by properly substituting hostname and port with your values
Example of valid server cert
Example of hostname:port not listening on TLS
Example of invalid cert
Business-initiated Calls
Prerequisites
You have the required call permission approval from the WhatsApp user Learn how to obtain user calling permissions Retrieve Meta generated SIP password and configure it on your SIP server, so it can respond to digest authentication challenge from Meta SIP serversCalling flow
Send an initial SIP INVITE to our servers. Our SIP domain is wa.meta.vc. To initiate a call to WhatsApp user with phone number 11234567890, the SIP request URI should be ‘sip:[email protected];transport=tls’ This request will fail with an “SIP 407 Proxy Authentication required” message. Send a 2nd SIP INVITE with proper Authorization header as per RFC 3261. The Authorization field’s username attribute must match the from header’s user name which is the business phone number The password is generated by Meta and you can retrieve it using get Call Settings endpoint The username portion of the from header must be the fully normalized business phone number The domain name of the from header must match the SIP server you configured on the business phone number TheSDP Offer you include supports ICE, DTLS-SRTP and OPUS (essentially WebRTC media)
Send the SIP INVITE to the WhatsApp user number you want to call.
User-initiated Calls
Prerequisites
If you plan to use SIP Digest Auth, retrieve Meta generated SIP password and configure it on your SIP server, so it can respond to digest authentication challenge from Meta SIP serversCalling flow
The WhatsApp user calls business phone number and is unaware of whether the business is using SIP or Graph API. In other words, the user experience is identical If the business phone number is SIP enabled, Meta will send an SIP INVITE to the SIP server configured on the business phone number You respond with SIP digest auth challenge (recommended) or SIP OK and pass in an SDP answer If you are not receiving SIP INVITE from Meta, refer to SIP specific FAQ to troubleshoot further View sample SIP requests Learn more about Session Description Protocol (SDP) View example SDP structuresCustom SIP Headers
We use following custom SIP headers specific to user-initiated callsConfigure/Update SIP settings on business phone number
Use this endpoint to update call settings configuration for an individual business phone number.Request syntax
Endpoint parameters
Request body
Body parameters
Success response
Error response
View Calling API Error Codes and Troubleshooting for more information View general Cloud API Error Codes hereGet phone number calling settings (SIP)
Use this endpoint to check the configuration of your Calling API feature settings, including SIP values. This endpoint can return information for other Cloud API feature settings.Request syntax
Endpoint parameters
App Permission Required
whatsapp_business_management: Advanced access is required to update use the API for end business clients

