Architecture

Auto-Provisioning (zero-touch desk phone setup)

Auto-provisioning is how you deploy 50, 500, or 50,000 desk phones without manually configuring each one. The phone boots, fetches its config from a central server using its MAC address, applies it, registers to the PBX. Eliminates field tech visits and configuration drift.

How it works

1. Phone boots, gets DHCP lease.
2. DHCP option 66 (TFTP server) or option 43 (vendor-specific) tells the phone where to fetch config.
3. Phone requests http://provserver/<mac-address>.cfg (or .xml).
4. Server reads MAC, looks up the customer + extension assignment in DB, returns a populated config file.
5. Phone applies config: SIP server FQDN, username, password, codecs, button labels, BLF subscriptions.
6. Phone registers and is ready.

Vendor-specific paths

Vendor	Provisioning URL pattern	Format
Polycom (HP/Poly)	http://server/<mac>.cfg (master) + <mac>-phone.cfg	XML
Yealink	http://server/<mac>.cfg + y000000000xxx.cfg (model)	INI
Snom	http://server/snom<model>-<mac>.xml	XML
Cisco	SEP<mac>.cnf.xml	XML
Grandstream	cfg<mac>.xml	XML or .bin
Fanvil	http://server/<mac>.cfg	INI / XML

Redirect-and-Provisioning Service (RPS)

Polycom ZTP, Yealink RPS, Snom Secure Redirect: vendors run a global redirect server. You buy a phone, register its MAC in the vendor's portal pointing at your provisioning URL, ship it directly to the customer. Customer plugs it in, phone calls vendor RPS, RPS sends it to your URL, phone provisions itself. Customer never touches a config menu.

This is how RingCentral, 8x8, Zoom Phone, and most cloud PBXs ship phones — pre-paired in the vendor's RPS portal.

Security

• HTTPS only: the config contains the SIP password. Don't serve over plain HTTP.
• MAC-based auth is weak: MAC addresses are public. Add a per-phone token in the URL path or use mutual TLS at the provisioning server.
• Encrypt sensitive sections: Polycom and Yealink support per-vendor config encryption with a customer key.
• Lock the SIP password to the device: if a phone is compromised, rotate just that one password.

DIDHub + provisioning

DIDHub does not host a provisioning server — that's a Class 5 / PBX function. Use FreePBX EndPoint Manager, 3CX provisioning, or a hosted PBX's provisioning. DIDHub's role is the SIP trunk under the PBX.

Related terms