# Create a SIP session credential

`POST /v1/voice/session-credentials`

Issues a workspace-scoped SIP digest credential valid for five minutes. The password appears only in this response; create another credential if you lose it. Trunks must allow session credentials to accept it.

The request has no body. Each successful request creates a fresh credential, including retries. Keep retries bounded: creating more than 20 live credentials for the same caller invalidates the oldest. Treat the password as a bearer secret until expires_at.

## Code samples

**TypeScript**

```ts
const credential = await bird.voice.sessionCredentials.create();
// The password is returned once. Until `expires_at` it can place billed calls.
console.log(credential.username, credential.realm, credential.expires_at);
```

Examples: [TypeScript](/docs/api/reference/create-voice-session-credential.ts.md) · [Python](/docs/api/reference/create-voice-session-credential.py.md) · [Go](/docs/api/reference/create-voice-session-credential.go.md) · [PHP](/docs/api/reference/create-voice-session-credential.php.md) · [CLI](/docs/api/reference/create-voice-session-credential.cli.md) · [MCP](/docs/api/reference/create-voice-session-credential.mcp.md) · [cURL](/docs/api/reference/create-voice-session-credential.curl.md)

## Example response `201`

```json
{
  "username": "bird",
  "password": "8Kx2mQ7pR4tYvB9nL3sW6dF1gH5jC0aZ",
  "realm": "01ARZ3NDEKTSV4RRFFQ69G5FAV.sip.bird.com",
  "expires_at": "2026-07-30T12:05:00Z",
  "handshake_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3ODU0NDMwMzV9.fp1xWxROEmgCafwiJ-ZHbZg9cIdYC-wLGcH-5gIVbco"
}
```

## Response body

- `username` (string, required): SIP digest username. Always `bird`. The credential identifies the workspace through `realm`. The username does not identify the workspace.
- `password` (string, required): SIP digest password, returned once. Treat it as a bearer secret: until it expires it can place calls billed to this workspace.
- `realm` (string, required): SIP digest realm to authenticate against. Workspace-scoped, so a credential minted for one workspace cannot authenticate against another.
- `expires_at` (string, required): When the credential stops authenticating, five minutes after creation. Existing calls may continue; use a fresh credential for later authentication.
- `handshake_token` (string): Short-lived token required when upgrading the WebSocket connection. The token authorizes the connection only; each call still authenticates with `password`.

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)