SIP trunking

Overview

SIP (Session Initiation Protocol) trunking allows you to connect your existing telephony infrastructure directly to ElevenLabs Agents. This integration enables all customers to use their existing phone systems while leveraging ElevenLabs’ advanced voice AI capabilities.

With SIP trunking, you can:

• Connect your Private Branch Exchange (PBX) or SIP-enabled phone system to ElevenLabs’ voice AI platform
• Route calls to AI agents without changing your existing phone infrastructure
• Handle both inbound and outbound calls
• Leverage encrypted TLS transport and media encryption for enhanced security

How SIP trunking works

SIP trunking establishes a direct connection between your telephony infrastructure and the ElevenLabs platform:

1. Inbound calls: Calls from your SIP trunk are routed to the ElevenLabs platform using your configured SIP INVITE address.
2. Outbound calls: Calls initiated by ElevenLabs are routed to your SIP trunk using your configured hostname, enabling your agents to make outgoing calls.
3. Authentication: Connection security for the signaling is maintained through either digest authentication (username/password) or Access Control List (ACL) authentication based on the signaling source IP.
4. Signaling and Media: The initial call setup (signaling) supports multiple transport protocols including TLS for encrypted communication. Once the call is established, the actual audio data (RTP stream) can be encrypted based on your media encryption settings.

Transport security: certificates and cipher suites

When you use TLS transport, both sides perform a TLS handshake before any SIP signaling is exchanged. During the handshake they validate a certificate and negotiate a cipher suite. The side that accepts the connection acts as the TLS server and presents the certificate; the side that opens the connection acts as the TLS client and validates it. ElevenLabs requires TLS 1.2 or higher.

The roles depend on the direction of the call:

• Inbound calls to ElevenLabs: Your system opens the connection, so ElevenLabs acts as the TLS server. ElevenLabs presents a valid certificate for sip.rtc.elevenlabs.io, and your system validates it as the TLS client.
• Outbound calls from ElevenLabs: ElevenLabs opens the connection to the address you configured, so your SIP server or SBC acts as the TLS server. Your system must present a valid, trusted certificate, which ElevenLabs validates as the TLS client.

Ensure both sides trust each other’s certificates and share at least one common cipher suite. If they do not, the TLS handshake fails before the call is established. See the SIP reference for definitions of these terms.

Follow-up connections

Some in-dialog requests, such as BYE or REFER, may require a new TLS connection when the original connection has already closed. The certificate behavior for these follow-up connections differs from the initial call setup:

• Follow-up connections to ElevenLabs: Your system establishes the connection to the Contact header address returned in the response, which resolves to a specific SIP server of the form <ip>.hosts.rtc.elevenlabs.io. That server presents a certificate valid for *.hosts.rtc.elevenlabs.io, which your system validates as the TLS client.
• Follow-up connections from ElevenLabs: When ElevenLabs initiates a TLS connection for a BYE or REFER, it connects to the address in the top-most Via header, which is often an IP address. Your system typically returns a certificate valid for a fully qualified domain name (FQDN) rather than that IP address. To validate this certificate, configure the Remote domains field in your phone number settings. If any domain the received certificate is valid for matches a configured remote domain, validation succeeds; otherwise it fails.

Making calls to ElevenLabs SIP trunk

When initiating calls to the ElevenLabs platform, you need to use the proper SIP URI format.

The ElevenLabs SIP trunk URI is:

sip:sip.rtc.elevenlabs.io:5060;transport=tcp

To make a call, construct a complete SIP URI that includes an identifier:

sip:+19991234567@sip.rtc.elevenlabs.io:5060

Where:

• +19991234567 is the identifier (typically a phone number in E.164 format)
• The identifier can also be any string value, such as 1000 or john

Requirements

Before setting up SIP trunking, ensure you have:

1. A SIP-compatible PBX or telephony system
2. Phone numbers that you want to connect to ElevenLabs
3. Administrator access to your SIP trunk configuration
4. Appropriate firewall settings to allow SIP traffic
5. TLS Support: For enhanced security, ensure your SIP trunk provider supports TLS transport
6. Audio codec compatibility: Your system must support either G711 or G722 audio codecs or be capable of resampling audio on your end. ElevenLabs’ SIP deployment outputs and receives audio at this sample rate. This is independent of any audio format configured on the agent for direct websocket connections.

Setting up SIP trunking

1

Navigate to Phone Numbers

Go to the Phone Numbers section in the ElevenLabs Agents dashboard.

2

Import SIP Trunk

Click on “Import a phone number from SIP trunk” button to open the configuration dialog.

3

Enter basic configuration

Complete the basic configuration with the following information:

• Label: A descriptive name for the phone number
• Phone Number: The E.164 formatted phone number to connect (e.g., +15551234567)

4

Configure transport and encryption

Configure the transport protocol and media encryption settings for enhanced security:

• Transport Type: Select the transport protocol for SIP signaling:
  • TCP: Standard TCP transport
  • TLS: Encrypted TLS transport for enhanced security
  • UDP: Connectionless transport (experimental; use TCP or TLS for production)
• Media Encryption: Configure encryption for RTP media streams:
  • Disabled: No media encryption
  • Allowed: Permits encrypted media streams
  • Required: Enforces encrypted media streams

Security Best Practice: Use TLS transport with Required media encryption for maximum security. This ensures both signaling and media are encrypted end-to-end.

5

Configure outbound settings

Configure where ElevenLabs should send calls for your phone number:

• Address: Hostname or IP address where the SIP INVITE is sent (e.g., sip.telnyx.com). This should be a hostname or IP address only, not a full SIP URI.
• Transport Type: Select the transport protocol for SIP signaling:
  • TCP: Standard TCP transport
  • TLS: Encrypted TLS transport for enhanced security
  • UDP: Connectionless transport (experimental; use TCP or TLS for production)
• Media Encryption: Configure encryption for RTP media streams:
  • Disabled: No media encryption
  • Allowed: Permits encrypted media streams
  • Required: Enforces encrypted media streams

Security Best Practice: Use TLS transport with Required media encryption for maximum security. This ensures both signaling and media are encrypted end-to-end.

The Address field specifies where ElevenLabs will send outbound calls from your AI agents. Enter only the hostname or IP address without the sip: protocol prefix.

6

Add custom headers (optional)

If your SIP trunk provider requires specific headers for call routing or identification:

• Click “Add Header” to add custom SIP headers
• Enter the header name and value as required by your provider
• You can add multiple headers as needed

Custom headers are included with all outbound calls and can be used for:

• Call routing and identification
• Billing and tracking purposes
• Provider-specific requirements

7

Configure authentication (optional)

Provide digest authentication credentials if required by your SIP trunk provider:

• SIP Trunk Username: Username for SIP digest authentication
• SIP Trunk Password: Password for SIP digest authentication

If left empty, Access Control List (ACL) authentication will be used, which requires you to allowlist ElevenLabs IP addresses in your provider’s settings.

Authentication Methods:

• Digest Authentication: Uses username/password credentials for secure authentication (recommended)
• ACL Authentication: Uses IP address allowlisting for access control

Digest Authentication is strongly recommended as it provides better security without relying on IP allowlisting, which can be complex to manage with dynamic IP addresses.

8

Complete Setup

Click “Import” to finalize the configuration.

Client Data and Personalization

To ensure proper forwarding and traceability of call metadata, include the following custom SIP headers in your webhook payload and SIP INVITE request:

• X-CALL-ID: Unique identifier for the call
• X-CALLER-ID: Identifier for the calling party

These headers enable the system to associate call metadata with the conversation and provide context for personalization.

Fallback Header Support

If the standard headers above are not present, the system will automatically look for the Twilio-specific SIP header:

• sip.twilio.callSid: Twilio’s unique call identifier

This fallback ensures compatibility with Twilio’s Elastic SIP Trunking without requiring configuration changes.

Processing Flow

Once the relevant metadata is received through any of the supported headers, the caller_id and/or call_id are available in the pre-call webhook and as system dynamic variables.

Inbound custom headers as dynamic variables

Custom SIP X- headers from inbound SIP trunking calls are automatically exposed as dynamic variables in the conversation.

Header names are normalized by removing the X- prefix, converting the name to lowercase, replacing hyphens with underscores, and adding the sip_ prefix. For example, X-Contact-ID becomes {{sip_contact_id}}, and X-Campaign-ID becomes {{sip_campaign_id}}.

Use these variables in agent prompts, first messages, and tools to personalize the conversation with caller-provided context. The values are also visible in the conversation history under the Phone Call tab.

Assigning Agents to Phone Numbers

After importing your SIP trunk phone number, you can assign it to a ElevenLabs agent:

1. Go to the Phone Numbers section in the ElevenAgents dashboard
2. Select your imported SIP trunk phone number
3. Click “Assign Agent”
4. Select the agent you want to handle calls to this number

Troubleshooting

Limitations and Considerations

• Support for multiple concurrent calls depends on your subscription tier
• Call recording and analytics features are available but may require additional configuration
• Outbound calling capabilities may be limited by your SIP trunk provider
• TLS Support: Ensure your SIP trunk provider supports TLS 1.2 or higher for encrypted transport
• Media Encryption: SRTP support varies by provider; verify compatibility before requiring encryption
• Audio format: ElevenLabs’ SIP deployment outputs and receives audio in G711 8kHz or G722 16kHz audio codecs. This is independent of any audio format configured on the agent for direct websocket connections. Your SIP trunk system must either support this format natively or perform resampling to match your system’s requirements

FAQ

Next steps

• SIP reference: glossary of SIP and networking terms
• Learn about creating ElevenLabs agents