Softphone embed cookbook - RFC 7118 SIP over WebSocket.
Two demo pages ship with every CodeB tenant: sip-js.html and jssip.html. They are complete browser softphones you can iframe into any customer app. If you need deeper control, initialise SIP.js or JsSIP directly against wss://phone.<tenant>:5443. European Digital Identity Wallet compatible - the same OIDC ID token prefills WS server, SIP URI, username and display name.
See also: 7 embed recipes
| Integration | Library / mechanism | Best for | Snippet |
|---|---|---|---|
| iframe embed | sip-js.html / jssip.html | Zero-code drop-in on any HTML page. | iframe-embed.html |
| SIP.js init | SIP.js SimpleUser | Custom UI, deep control of session events. | sipjs-init.js |
| JsSIP init | JsSIP UA | Custom UI, JsSIP feature parity. | jssip-init.js |
| React wrapper | iframe component | React SPAs. | softphone-react.jsx |
| Vue wrapper | iframe component | Vue 3 SPAs. | softphone-vue.js |
| Angular wrapper | iframe component | Angular SPAs. | softphone-angular.ts |
| WordPress shortcode | PHP plugin | WordPress sites; no JavaScript wiring. | softphone-wordpress.php |
Authentication model
The softphone signs in with per-user SIP credentials over RFC 7118 SIP-over-WebSocket. Credentials live only in localStorage on the visitor's device. Optionally, CodeB OIDC autofill (Sign in with CodeB) prefills the WS server, SIP URI, username and display name from the ID token; the SIP password remains a per-account secret typed once and cleared by the Forget button.
RASP posture
The signalling channel is the SIP-over-WebSocket registrar - protected by IpAllowGate, per-tenant rate limits and loud [SIGNAL-*] + [SIPWS-*] diagnostics at every branch. Any embed you ship inherits these controls; nothing about the iframe or library init changes the server-side posture.
NIS2 / DORA / CRA
Embedded softphones inherit the tenant's audit trail (per-call CDR, per-registration LOUD-diag lines) so NIS2 incident detection and DORA operational-resilience monitoring flow through the same pipes. CRA product-side auditability is met by tenant-scoped log files ingested via the SIEM cookbook.
FAQ
Structured answers embedded in the schema block above.