SIP.IO
Start free

Embedded Softphone (WebRTC)

Short answer: SIP.IO gives you a production-ready WebRTC auth foundation for browser-based calling: POST /v1/softphone/token mints a short-lived SIP credential and ICE server list for a browser to register with, the same model as Twilio Access Tokens. A packaged client SDK, floating widget, and screen-pop helpers for a copy-paste embed are on the roadmap.

What’s live today

  • Ephemeral SIP credentials. POST /v1/softphone/token mints a one-time, short-lived credential for an existing user identity (no long-lived SIP password ever reaches the browser). It creates a real (but temporary) device on that user’s account, so inbound calls ring the browser tab just like any desk phone or app in that user’s multi-device fork.
  • Enforced expiry. Tokens default to a 1-hour TTL (clamped 5 minutes to 24 hours) and are checked on every REGISTER and INVITE, not just at mint time. Expired credentials are reaped automatically, both lazily on the next mint and on a global cron sweep.
  • TURN credentials for NAT traversal. The token response includes an iceServers array with STUN and, where TURN is configured, the TURN relay TURN REST API credentials (HMAC-signed, minted fresh per token, no static secret shared with the browser). This is what lets the call connect from behind restrictive corporate or hotel firewalls.
  • WSS on 443, one shared host per region. The browser registers over WebSocket Secure on port 443 (not an alternate port), against a single shared regional host (webrtc-<region>.sip.io). Tenant identity lives at the SIP layer, not the hostname, so this works through networks that block anything but standard HTTPS ports.
  • Bring your own WebRTC client. Until SIP.IO ships its own SDK, the token endpoint is usable directly: mint a token from your backend, hand the credential and iceServers to any SIP.js or JsSIP-based client, and register.

What’s on the roadmap

  • A published @sipio/softphone client SDK wrapping token fetch, registration, and call control behind a small JS API.
  • A floating widget for embedding call UI without building it from scratch.
  • Screen-pop helpers linking a call to CRM record context (the screenPop field already accepted by click-to-call is intended for this).
  • CRM connector packages for common platforms.

The token endpoint is production-ready to build embedded browser calling on today; the packaged, drop-in experience is what’s still ahead.

FAQ

Does SIP.IO have an embeddable softphone widget today? The auth and connectivity foundation (token endpoint, TURN credentials, WSS transport) is live today, ready to build browser calling on; the packaged SDK, widget, screen-pop, and CRM connectors are on the roadmap.

Can I build a browser softphone with SIP.IO right now? Yes. Mint a token with POST /v1/softphone/token, then use any SIP.js or JsSIP-based client in the browser with the returned credential and iceServers.

How does the softphone token avoid putting a real password in the browser? It’s a one-time, short-lived credential scoped to an existing user, with expiry enforced on every REGISTER and INVITE, not a long-lived SIP password.

Full technical docs · Click to call (the other half of embedded calling) · UCaaS: users & devices · Platform overview · Pricing