Skip to main content

Session Initiation Protocol (SIP)

Updated: Nov 18, 2025 When SIP is enabled, you cannot use calling related Graph API endpoints and calling related webhooks are not sent.

Overview

Session Initiation Protocol ( SIP) is a signaling protocol used for initiating, maintaining, modifying, and terminating real-time communication sessions between two or more endpoints. WhatsApp Business Calling API supports use of SIP as the signaling protocol instead of our Graph API endpoints and Webhooks.

Before you get started

Before you get started with SIP call signaling, confirm the following: You meet overall calling pre-requisites Your app has messaging permissions for the business phone number you want to enable SIP for. Test this by sending and receiving messages using Graph API messaging endpoints, then use the same app to configure your SIP server on the business phone number for calling. Double confirm this by using health status API with PHONE_NUMBER_ID Your app mode is “Live”, not “Development”. You have a standards compliant third party SIP server that supports TLS transport and digest authentication

Signaling and media possible configurations

*Note: You can use SDES instead of ICE+DTLS with Graph API + Webhook signaling

Calling flows using SIP

Before you start, make sure you have enabled and configured SIP on the business phone number. Meta generates a unique SIP user password for each business phone number + app combination. You will need this information and can retrieve it by using the get Call Settings endpoint.

Security

TLS transport is mandatory for SIP. Meta will present a valid server cert with subject name that covers our SIP domain wa.meta.vc. Your SIP server should do the same as Meta ensures your cert is valid and subject name covers SIP domain you configured on the business phone number Meta does NOT support mutual TLS (aka mTLS). This means, when Meta takes the role of a TLS client, your TLS server should not request Client certificate. If you still request client cert, Meta will present a client cert but the cert subject name would refer to a random dynamic host which will not pass certificate validation. Meta adds transport=TLS to request URI as part of it’s SIP requests to partner SIP server For business initiated calls, SIP invite from your SIP server will be challenged using digest auth. See business-initiated calls for more details For user initiated calls, it is highly recommended that you challenge SIP INVITE request from Meta, to use digest auth for more security. See user-initiated calls for more details

How to test if you have a valid TLS certificate

When a WhatsApp user calls a business, a common reason for your SIP server to not receive the SIP INVITE from Meta is the certificate validation error. You can use information here to confirm valid setup. Run the command openssl s_client -quiet -verify_hostname {hostname} -connect {hostname}:{port} by properly substituting hostname and port with your values

Example of valid server cert

Example of hostname:port not listening on TLS

Example of invalid cert

In this case, you can alter the certificate to match your hostname or change your configured SIP server hostname to match your certificate

Business-initiated Calls

Prerequisites

You have the required call permission approval from the WhatsApp user Learn how to obtain user calling permissions Retrieve Meta generated SIP password and configure it on your SIP server, so it can respond to digest authentication challenge from Meta SIP servers

Calling flow

Send an initial SIP INVITE to our servers. Our SIP domain is wa.meta.vc. To initiate a call to WhatsApp user with phone number 11234567890, the SIP request URI should be ‘sip:[email protected];transport=tls’ This request will fail with an “SIP 407 Proxy Authentication required” message. Send a 2nd SIP INVITE with proper Authorization header as per RFC 3261. The Authorization field’s username attribute must match the from header’s user name which is the business phone number The password is generated by Meta and you can retrieve it using get Call Settings endpoint The username portion of the from header must be the fully normalized business phone number The domain name of the from header must match the SIP server you configured on the business phone number The SDP Offer you include supports ICE, DTLS-SRTP and OPUS (essentially WebRTC media) Send the SIP INVITE to the WhatsApp user number you want to call.

User-initiated Calls

Prerequisites

If you plan to use SIP Digest Auth, retrieve Meta generated SIP password and configure it on your SIP server, so it can respond to digest authentication challenge from Meta SIP servers

Calling flow

The WhatsApp user calls business phone number and is unaware of whether the business is using SIP or Graph API. In other words, the user experience is identical If the business phone number is SIP enabled, Meta will send an SIP INVITE to the SIP server configured on the business phone number You respond with SIP digest auth challenge (recommended) or SIP OK and pass in an SDP answer If you are not receiving SIP INVITE from Meta, refer to SIP specific FAQ to troubleshoot further View sample SIP requests Learn more about Session Description Protocol (SDP) View example SDP structures

Custom SIP Headers

We use following custom SIP headers specific to user-initiated calls

Configure/Update SIP settings on business phone number

Use this endpoint to update call settings configuration for an individual business phone number.

Request syntax

Endpoint parameters

Request body

Body parameters

Success response

Error response

View Calling API Error Codes and Troubleshooting for more information View general Cloud API Error Codes here

Get phone number calling settings (SIP)

Use this endpoint to check the configuration of your Calling API feature settings, including SIP values. This endpoint can return information for other Cloud API feature settings.

Request syntax

Endpoint parameters

App Permission Required

whatsapp_business_management: Advanced access is required to update use the API for end business clients

Response body

Include SIP User Password

Optionally, you can include SIP user credentials in your response body by adding the SIP credentials query parameter in the POST request:
Where the response will look like this:

Error response

View Calling API Error Codes and Troubleshooting for more information View general Cloud API Error Codes here

Reset SIP password

To make Meta generate a new SIP password, you’d need to disable SIP, delete SIP server and add your SIP server back. Fetch your SIP configuration with password to view your current password for your reference Disable and delete your SIP server
Enable SIP and add your SIP server
Fetch your SIP configuration with password to note the new password

Sample SIP requests

Business-initiated calls (with WebRTC media)

Initial SIP INVITE request

407 response from Meta

Second SIP INVITE send with authorization

Example error response

SIP BYE

SIP Invite (with SDES)

SIP OK (with SDES)

User-initiated calls (with WebRTC media)

SIP INVITE

SIP BYE

SIP Invite (with SDES)

SIP OK (with SDES)

User-initiated calls with Digest Auth (with SDES media)

Meta SIP server supports digest auth for user initiated calls. Your SIP server should respond with digest auth challenge and Meta will resend the SIP INVITE with challenge response. The username used for digest auth is the (normalized) business phone number and the password is generated by Meta and retrievable using the get Call settings endpoint.

First INVITE request from Meta

407 Response from partner SIP server

Second INVITE with authorization from Meta

SIP OK from partner SIP server

Configure SDES for SRTP key exchange protocol

The Secure Real-time Transport Protocol (SRTP) key exchange is a cryptographic protocol used to securely exchange encryption keys between two parties over an insecure communication channel. You can configure SRTP key exchange to one of two options: DTLS (default) — Industry-standard encrypted key exchange. Recommended. SDES — Plain text key is defined in the SDP which is sent over secure signaling protocol (SIP) or Graph API. When SDES is used, there is no need for STUN, ICE and DTLS which could help shorten the call setup time.

Configure/update SRTP key exchange protocol

Request syntax

Endpoint parameters

Request body

Body parameters

Success response

Error response

View Calling API Error Codes and Troubleshooting for more information View general Cloud API Error Codes here

Get SRTP key exchange protocol

Request syntax

Endpoint parameters

Response body

Response parameters

Error response

View Calling API Error Codes and Troubleshooting for more information View general Cloud API Error Codes here

IP Addresses

The IP addresses used for SIP configuration are the same as those listed for the Webhooks in the Cloud API Webhooks IP Addresses section. This reference is solely to indicate the IP addresses to allow-list for SIP traffic. When SIP is enabled, calling related webhooks are not sent.

Troubleshooting

Refer to SIP FAQ for additional SIP specific questions and answers and SIP Errors for SIP specific errors and solutions Did you find this page helpful? Thumbs up icon Thumbs down icon ON THIS PAGE Overview Before you get started Signaling and media possible configurations Calling flows using SIP Security How to test if you have a valid TLS certificate Example of valid server cert Example of hostname:port not listening on TLS Example of invalid cert Business-initiated Calls Prerequisites Calling flow User-initiated Calls Prerequisites Calling flow Custom SIP Headers Configure/Update SIP settings on business phone number Request syntax Endpoint parameters Request body Body parameters Success response Error response Get phone number calling settings (SIP) Request syntax Endpoint parameters App Permission Required Response body Include SIP User Password Error response Reset SIP password Sample SIP requests Business-initiated calls (with WebRTC media) Initial SIP INVITE request 407 response from Meta Second SIP INVITE send with authorization Example error response SIP BYE SIP Invite (with SDES) SIP OK (with SDES) User-initiated calls (with WebRTC media) SIP INVITE SIP BYE SIP Invite (with SDES) SIP OK (with SDES) User-initiated calls with Digest Auth (with SDES media) First INVITE request from Meta 407 Response from partner SIP server Second INVITE with authorization from Meta SIP OK from partner SIP server Configure SDES for SRTP key exchange protocol Configure/update SRTP key exchange protocol Request syntax Endpoint parameters Request body Body parameters Success response Error response Get SRTP key exchange protocol Request syntax Endpoint parameters Response body Response parameters Error response IP Addresses Troubleshooting