Skip to main content
You set up a Thread trunk earlier so your Voice AI agent transfers callers to 3CX over SIP. Today your 3CX forwards callers to the agent’s Thread number over the phone network. These steps add an inbound side to the same trunk, so that forward travels over SIP instead and the agent sees the caller’s real number. Your outbound settings, custom headers and linked agents stay as they are, and one 3CX trunk carries both directions. The steps were written against 3CX v20. To set up both directions from scratch, follow Connect 3CX to Voice AI with a SIP trunk instead. 3CX names each direction from its own point of view, so Thread’s names flip:

​
In 3CX: switch your trunk to the Thread template

1

Install the Thread Voice AI template

3CX’s built-in Generic SIP Trunk template puts your own 3CX number in the caller fields of calls it sends out, so a forwarded caller would reach the agent as your 3CX number. The Thread Voice AI template sends the original caller instead.Download ThreadVoiceAI.pv.xml and keep the file name as it is. In the 3CX Admin console, go to Advanced > Templates > Provider Templates, select Add, choose the file, and select Create in the dialog that opens.
3CX Add Template dialog with the template name ThreadVoiceAI, country and trunk field visibility options, and a Create button

Keep the defaults and select Create.

2

Switch your transfer trunk to the template

In Voice & Chat, open the menu (⋮) on the trunk that receives Thread’s transfers today and select Switch Template. Set Provider to Thread Voice AI and select OK. Your 3CX keeps using the same trunk for both directions.Switching keeps the trunk’s name, Main Trunk Number, authentication, DIDs, call limit, caller ID and codec settings. It clears Registrar/Server, and on the Options tab it sets Transport Protocol to Any and SRTP Mode to Disabled. 3CX won’t save the trunk until Registrar/Server is filled in again, so nothing changes for live calls yet. Leave the trunk’s settings open; steps 6 to 8 fill them back in.
3CX trunk row menu with Edit Trunk, Delete Trunk, Refresh Registration, Check SIP Trunk, Switch Template, Sync Template and View Template

Switch Template is in the trunk's menu in Voice & Chat.

3CX Choose your SIP Trunk VoIP Provider dialog with Provider set to Thread Voice AI

Pick Thread Voice AI as the provider. It appears once the template is installed.

​
In Thread: copy Thread’s SIP address and set encryption

3

Open your existing trunk

In a new tab, go to Voice > SIP Trunks & Caller ID and open the trunk. Its outbound side shows Configured with its switch on, and the inbound side shows Optional.
Trunk page with Inbound trunk Optional and a Set up trunk button, Outbound trunk Configured over TLS+SRTP with its switch on, and one linked agent

Starting point: outbound only, with your agents linked.

4

Under Inbound trunk, select Set up trunk

Step 1 shows Thread’s SIP address. Copy it for the 3CX trunk. Set Media encryption to Required (recommended) so the audio of every forwarded call is encrypted with SRTP. Choose Disabled only if you won’t turn SRTP on in 3CX.
Thread inbound trunk settings step 1, Point your phone system to Thread, with Thread's SIP address and media encryption set to Required

Thread's SIP address in the inbound settings

5

Choose how Thread recognizes your 3CX

Pick one option. The 3CX settings in step 7 change to match.
  • Allowed addresses: Thread accepts calls only from the IPs you list, one per line. 3CX shows its public IP on every trunk page, next to Use this IP for Whitelisting.
  • Username and password: 3CX answers a challenge on every call. Pick a username unique to this trunk and a long, randomly generated password (20 or more characters from a password manager). Don’t reuse credentials from anywhere else or use defaults like admin/admin. Keep them for step 7. Choose this if your 3CX is hosted and shares an IP with other customers.
  • Leave the address list empty: Thread accepts calls from any address. Anyone who knows Thread’s SIP address and your agent’s number can then call the agent with any caller number, so prefer one of the options above.
Inbound step 2, Restrict who can call, with Allowed addresses chosen and a text area for IP addresses or CIDR blocks

Allowed addresses: one IP or CIDR block per line. Left empty, any address is allowed.

Inbound step 2 with Username and password chosen, a username filled in and the password field below it

Username and password. These are separate from any outbound credentials.

Select Continue, and leave this page open.

​
In 3CX: point the trunk at Thread

6

Name the trunk and paste Thread's SIP address

Back on the trunk’s General tab, check its Name and Main Trunk Number. Under Server Details, paste Thread’s SIP address into Registrar/Server and keep Port on 5060. Leave Outbound Proxy empty.
3CX trunk General tab with Name Thread Voice AI, a Main Trunk Number, and Registrar/Server set to Thread's SIP address on port 5060

Name, Main Trunk Number and Registrar/Server filled in. Port stays on 5060.

Keep the Registrar port on 5060, because 3CX can’t send calls to Thread over TLS. Thread’s SIP address uses a wildcard certificate (*.sip.livekit.cloud), and 3CX only accepts a certificate that matches the trunk’s Registrar name exactly, with no setting to relax that check. On TLS, 3CX fails the forward with 503 Certificate Name Mismatch (shown as 503 Service Unavailable in the Event Log) before the call reaches Thread. SRTP still encrypts the call audio.
7

Fill in authentication to match step 5

On the same tab, use the row for the option you chose in step 5:
3CX trunk General tab with an authentication ID and password filled in, Do not require - IP based authentication, and Thread's SIP address as the registrar on port 5060

The username and password version. For allowed addresses, leave both credential fields empty.

Use Do not require - IP based for both options; 3CX still answers Thread’s password challenge on each call. Outbound - outbound only and Register/Account based make 3CX register with Thread, which answers 405 Method Not Allowed. 3CX then treats the trunk as down, and the call fails or falls through to a backup route.
8

Set encryption to match step 4, then save

Open the trunk’s Options tab. Switching the template reset SRTP Mode, so set it again to match Thread’s media encryption. Encrypted audio is the recommended choice. Then select Save.
3CX trunk Options tab, Configuration section, with Transport Protocol UDP and SRTP Mode Enforced

SRTP Mode set to Enforced. Transport Protocol can stay on the template's setting.

9

Check that the transfer number is still a DID

On the trunk’s DID Numbers tab, make sure the number your Thread Attendant agent transfers to is still listed, and add it if it isn’t. 3CX accepts a call from Thread only when it arrives on a DID the trunk knows. Select Save.
3CX trunk DID Numbers tab with +12025550110 listed as a DID

The transfer number listed in E.164 format.

10

Add an Outbound Rule for Thread's test number

Thread’s test number is in your trunk’s country, from a range that’s never given to real phones, and 3CX dials it as a domestic call. In Outbound Rules, add a rule for it with Route 1 on the Thread trunk and Strip no digits. 3CX compares a number after removing your own country code, so the prefix leaves the country code out and Prepend puts it back:The next step dials the test number. Make sure no higher rule catches it first. You can delete this rule once the test passes.
3CX outbound rule Thread test numbers with prefix 999, and Route 1 on the Thread Voice AI trunk with Strip no digits and Prepend +1

A US trunk: prefix 999 without the country code, and Prepend +1 puts it back.

​
In Thread: test the inbound side

11

Test the inbound side

Back on Thread’s inbound page, at step 3 Test connection, select Start listening. Thread shows a test number in your trunk’s country, which the test rule sends to the Thread trunk. Dial the number from a 3CX extension. The call appears in Thread with the caller and the headers 3CX sent, which confirms your address or credentials and encryption work. 3CX may log the call as busy, because Thread ends test calls right away. Select Complete, then Save at the bottom of the inbound page to return to the trunk page.If nothing appears, check the allowed addresses or credentials from steps 5 and 7, that the 3CX trunk sends to port 5060, and that no higher Outbound Rule catches the test number. Thread can only see calls it accepts, so check your 3CX logs to find out why calls are failing.
Inbound Test connection step listening, with the test number and SIP host in copy fields, a green Thread accepted this call banner and one received call showing time, from, to and display name

A call Thread accepted. Expand Headers to see what 3CX sent.

​
In 3CX: route the agents’ numbers to Thread

12

Add an Outbound Rule for the agent's numbers

In Outbound Rules, add a rule whose prefix is the agent’s Thread number without the country code (for +1 202 555 0142, enter 2025550142). Set Route 1 to the Thread trunk, Strip no digits, and Prepend the country code, +1 in the US and Canada.The agent’s numbers are in Thread under Voice > Agents: the Attendant number is under Your attendant phone number on the agent’s Attendant tab, and the Overflow number under Your overflow phone number on its Overflow tab. The trunk page also lists both next to the agent. Add a rule for both the Attendant and the Overflow number, so 3CX sends every forward to the agent over SIP.Make sure no higher rule catches the number first. If a call still doesn’t match, Dashboard > Activity logs shows the number 3CX compared on a line like Looking for outbound rule: dialed = [+12025550142], processed: [2025550142]; use the processed form as the prefix. Then delete the test-number rule.
Voice agent Attendant tab with Your attendant phone number showing +1 202-555-0142 and a copy button

The Attendant number, on the agent's Attendant tab.

Voice agent Overflow tab with Your overflow phone number showing +1 202-555-0187 and a copy button

The Overflow number, on the agent's Overflow tab.

3CX outbound rule with the agent's number 2025550142 as the prefix, Route 1 on the Thread Voice AI trunk, Strip no digits and Prepend +1

Route 1 goes to Thread. A backup route can follow, but it will hide failures while you test.

Add this rule before you turn inbound on in the next step. Saving the trunk moves the agent’s number onto the SIP trunk, so a forward still going over the phone network would stop reaching the agent.

​
In Thread: turn inbound on

13

Turn inbound on and save the trunk

The trunk page now shows both sides as Configured. Agents already linked to the trunk apply to both directions. If you chose Required, also select Edit settings under Outbound trunk and change the transport to TLS+SRTP, so transfers to 3CX are encrypted the same way. Turn on the switch on the Inbound trunk card. It starts off, because your agents are so far linked only to the outbound side. Then select Save at the bottom of the trunk page to turn inbound on.
Trunk page with Inbound and Outbound trunk cards both Configured with their switches on, and one linked agent with an Unlink agent button

Both sides configured and switched on, one linked agent. Saving moves the agent's number onto this trunk.

​
In 3CX: send callers over SIP

14

Keep your existing forward

The DID, IVR option or queue that already forwards to the agent’s Thread number doesn’t change. With the rule from step 12, 3CX should now send that forward over SIP instead of the phone network.
15

Place a test call

Call your support number from a mobile. The agent answers and, when it transfers, your technician’s 3CX client shows the caller’s own number.
To stop using one direction later, switch it off on the trunk page in Thread and select Save. Its settings stay, so you can switch it back on. While agents are linked to the trunk, at least one direction has to stay on. To turn off both, select Disconnect all agents from the trunk’s menu in the SIP trunk list. If a forward or transfer fails, see Troubleshoot the connection.