VoIP.infoThe independent guide to business communications.
VoIP.info Guide

PBX credentials and extension secrets

Keep administrator, handset, trunk and backup identities separate and retire them deliberately.

Reviewed 2026-10-19Foundational

Different secrets grant different authority

A handset secret permits an endpoint relationship. A trunk credential can permit chargeable service. Administrative access can change the entire platform. Backup credentials can expose configuration and other stored data. Reusing one secret across these roles increases the consequence of a single compromise.

Provision without broad disclosure

Use unique strong secrets and a controlled provisioning process. Do not store them in screenshots, public issue reports or ordinary call-flow diagrams. Restrict configuration exports and remove temporary copies after their authorized purpose ends.

Track ownership

Maintain an inventory of account owner, device or service, permission scope and rotation/revocation procedure. Shared-area phones need an accountable owner even when no employee is named on the device.

Revoke completely

When staff or contractors leave, review forwarding, voicemail, remote access and management permissions as well as the visible extension name. Rotate relevant credentials and verify that retired devices cannot re-register. A factory reset of one handset does not invalidate copies of its secret elsewhere.

Handle FreePBX API secrets as distinct credentials

A FreePBX API client secret, access token and refresh token are different records from an administrator password or SIP authentication secret. The API applications guide uses fingerprints and application IDs for diagnostics without copying raw credentials into logs.

Rotate AMI secrets through the true configuration owner

The AMI login diagnostic preserves the exact authentication mode while keeping secret, key and challenge material out of records.

Keep TelVox API keys and SIP passwords in separate controls

TelVox API keys are unscoped server credentials, while each trunk has a separate SIP password and WSS seats expose a long-lived password to the browser. The provider record sets distinct storage, delivery, logging and rotation boundaries.

Correlate authentication events without exposing secrets

The security-event guide preserves account, service, session and address evidence while keeping credentials and challenge material out of routine reports.

Keep CURL credentials out of URLs and logs

The Asterisk CURL guide records option names and redacted outcomes without exposing cookies, authorization headers, user-password strings or key passphrases.

Classify validation evidence without logging secrets

The input-parsing diagnostic records lengths and redacted result classes instead of raw credentials or headers.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Continue your research

Hub

VoIP security

Reduce PBX exposure, constrain calling permissions and prepare for accountable recovery.

Explore topic →
Guide · Asterisk 22 LTS

Secure an Asterisk PBX before adding paid calling

Review management access, endpoint identities and dialplan permissions as separate layers.

Read guide →
Guide · FreePBX Backup & Restore release/17.0 source, FreePBX advisories GHSA-5v7h-49gr-jcwr and GHSA-f6hc-rqxg-ch86, and Sangoma Filestore, backup, fwconsole and FreePBX 17 migration documentation reviewed October 12, 2026; the advisories identify affected Backup & Restore versions below 17.0.6 and 17.0.30 respectively, but repository or advisory state does not prove the installed module, archive custody, target handlers or restored runtime, and no PBX, archive, storage destination, credential, job, restore, module, endpoint, trunk or call was inspected or tested

FreePBX backup and restore: prove the recovery path

Choose backup scope, protect off-host storage and validate an isolated restore before relying on it.

Read guide →
Guide · Operational guidance; Asterisk 22 / FreePBX 17 where applicable

Least privilege for PBX users and integrations

Separate the right to register, place calls, administer the PBX and read sensitive data.

Read guide →
Guide · Operational guidance; Asterisk 22 / FreePBX 17 where applicable

SIP scanning, failed registration and rate limits

Distinguish routine authentication challenges from abuse and contain bursts without locking out a site.

Read guide →
Guide · FreePBX PBX API release/17.0 repository, module metadata and Sangoma documentation reviewed October 12, 2026; repository metadata reported API module 17.0.9 and support for FreePBX 17.0, but the installed module, active schemas, enabled consumers, certificates, proxy path and application records remain deployment-specific, and no PBX, application, credential, token, scope, API request, mutation, database row or network path was inspected or tested

FreePBX API applications: OAuth, scopes and GraphQL

Create a bounded FreePBX API application while keeping client identity, grant type, token issuance, allowed scopes, active module schema and each GraphQL operation independently observable.

Read guide →
Troubleshooting · FreePBX PBX API release/17.0 repository, module metadata and Sangoma documentation reviewed October 12, 2026; repository metadata reported API module 17.0.9 and support for FreePBX 17.0, but the installed module, active schemas, enabled consumers, certificates, proxy path and application records remain deployment-specific, and no PBX, application, credential, token, scope, API request, mutation, database row or network path was inspected or tested

FreePBX API token or GraphQL request fails

Trace one FreePBX API request through served origin, application identity, OAuth grant, token issuance, scope, active GraphQL schema, operation and resolver outcome.

Read guide →
Guide · Asterisk branch-23-generated Login, Challenge, Logoff and Events references, branch-22-generated Login reference, and official AMI syntax, v2, permission and network-security documentation reviewed October 16, 2026; installed branch and maintenance release, listener and transport, manager.conf ownership, username, secret rotation, ACL, read and write classes, login event mask, connection lifetime, client timeout, reconnect policy and downstream operations remain deployment specific; no PBX, manager configuration, credential, ACL, socket, manager session, request, response, event, channel, packet, media stream or live call was inspected or tested

Asterisk AMI session authentication, Login, Logoff and Challenge

Keep manager identity, authentication exchange, transport protection, event mask, permissions and session lifetime as separate AMI evidence.

Read guide →
Troubleshooting · Asterisk branch-23-generated Login, Challenge, Logoff and Events references, branch-22-generated Login reference, and official AMI syntax, v2, permission and network-security documentation reviewed October 16, 2026; installed branch and maintenance release, listener and transport, manager.conf ownership, username, secret rotation, ACL, read and write classes, login event mask, connection lifetime, client timeout, reconnect policy and downstream operations remain deployment specific; no PBX, manager configuration, credential, ACL, socket, manager session, request, response, event, channel, packet, media stream or live call was inspected or tested

Asterisk AMI login fails or the session drops

Trace one failed login or lost manager session through listener identity, protected reachability, framing, authentication fields, manager account policy and the exact termination boundary.

Read guide →
Provider research · Current TelVox Connect trunk, authentication, call, number, recording, webhook, pricing and security documentation plus Renav Limited company identification reviewed October 16, 2026; Connect is live but its API is v0.x, and coverage, portability, emergency calling, fax, messaging, codecs, DTMF transport, RTP, media protection, redundancy, concurrency, call-start limits, availability, compatibility, exact pricing and support performance remain account, order, route or version specific; no account, API key, trunk, SIP credential, number, registration, webhook, callback, recording, packet, media stream, emergency call or live call was inspected or tested

TelVox Connect SIP trunks: provisioning, credentials and call evidence

Separate TelVox API access, trunk lifecycle, SIP registration, webhooks, callbacks and call outcomes while keeping pre-v1 and account-specific limits explicit.

Read guide →
Asterisk · Current first-party Asterisk security-framework, logging, command, configuration and source evidence reviewed October 18, 2026. Security-event generation, res_security_log module state, dynamic SECURITY level registration, logger channel configuration, destination path, file write, rotation, downstream parser, alert and enforcement action remain separate evidence. A security event is not by itself proof of compromise, and a written record is not proof of a ban or alert. No host, module, logger channel, file, permission, event, parser, firewall, packet, account or call was inspected or tested

Asterisk security-event logging: generation, channel and custody evidence

Trace a security event from the producing subsystem through res_security_log, the dynamic SECURITY level, logger channel, file custody, rotation and downstream consumers.

Read guide →
Troubleshooting · Current first-party Asterisk security-framework, logging, command, configuration and source evidence reviewed October 18, 2026. Security-event generation, res_security_log module state, dynamic SECURITY level registration, logger channel configuration, destination path, file write, rotation, downstream parser, alert and enforcement action remain separate evidence. A security event is not by itself proof of compromise, and a written record is not proof of a ban or alert. No host, module, logger channel, file, permission, event, parser, firewall, packet, account or call was inspected or tested

Asterisk security events are missing, too noisy or not reaching enforcement

Separate event generation, res_security_log state, dynamic logging level, channel path, file custody, rotation, parser, alert and defensive action.

Read guide →
Guide · Current Asterisk Latest API CURL, CURLOPT, JSON_DECODE and URIENCODE references, the Asterisk CLI guide, the upstream func_curl implementation and the official libcurl connection and whole-transfer timeout references were reviewed October 19, 2026. The generated Asterisk API pages reported branch 23; the installed Asterisk and libcurl versions, loaded modules, channel and global options, DNS, proxy, certificate store, remote service, response schema and elapsed call-path behavior remain deployment specific. No PBX, module, dialplan, credential, DNS answer, proxy, certificate, remote service, response, packet, media stream or live call was inspected or tested

Asterisk CURL: make HTTP dialplan lookups bounded and auditable

Separate URL construction, channel-scoped options, connection and whole-transfer limits, HTTP handling, response parsing and fallback routing for remote dialplan lookups.

Read guide →
Troubleshooting · Current Asterisk Latest API CURL, CURLOPT, JSON_DECODE and URIENCODE references, the Asterisk CLI guide, the upstream func_curl implementation and the official libcurl connection and whole-transfer timeout references were reviewed October 19, 2026. The generated Asterisk API pages reported branch 23; the installed Asterisk and libcurl versions, loaded modules, channel and global options, DNS, proxy, certificate store, remote service, response schema and elapsed call-path behavior remain deployment specific. No PBX, module, dialplan, credential, DNS answer, proxy, certificate, remote service, response, packet, media stream or live call was inspected or tested

Asterisk CURL is empty, slow, redirected or returns an unsafe response

Trace one remote dialplan lookup through URL ownership, effective options, DNS and connect timing, TLS and HTTP handling, bounded response parsing and the fallback branch.

Read guide →
Guide · Current Asterisk Latest API FILTER, REGEX, ISNULL, LEN, FIELDQTY and CUT references, the dialplan-functions overview and the upstream func_strings implementation were reviewed October 19, 2026. The generated API pages reported branch 23; the installed branch, compiled and loaded modules, parser escaping, channel-variable content, delimiter, pattern, downstream application and call outcome remain deployment specific. No PBX, module, dialplan, channel, variable, external input, parsed field, route, packet, media stream or live call was inspected or tested

Asterisk dialplan input validation and field parsing

Keep presence, length, allowed-character filtering, full-shape validation, delimiter count and field extraction as separate dialplan decisions.

Read guide →
Troubleshooting · Current Asterisk Latest API FILTER, REGEX, ISNULL, LEN, FIELDQTY and CUT references, the dialplan-functions overview and the upstream func_strings implementation were reviewed October 19, 2026. The generated API pages reported branch 23; the installed branch, compiled and loaded modules, parser escaping, channel-variable content, delimiter, pattern, downstream application and call outcome remain deployment specific. No PBX, module, dialplan, channel, variable, external input, parsed field, route, packet, media stream or live call was inspected or tested

Asterisk dialplan input is empty, truncated or misparsed

Trace one value through assignment, length, filtering, regex syntax, delimiter count, CUT variable ownership and the first downstream branch.

Read guide →