Obtain a STIR/SHAKEN certificate from an authorized Certificate Authority listed in the ATIS/SIP Forum Certificate Policy; since September 2025 the FCC requires every obligated voice provider to sign calls with their own certificate rather than relying on an upstream provider.
Integrate an authentication service (AS) — either a vendor product or open-source library — that accepts call metadata (calling number, called number, timestamp) and produces a signed PASSporT JWT using your certificate's private key.
Select the attestation level: Full (A) if you authenticated the subscriber and they are authorized to use the calling number; Partial (B) if you authenticated the subscriber but cannot confirm number authorization; Gateway (C) if you can only authenticate the call's source.
The AS encodes the PASSporT as a compact JWS and inserts it into the SIP Identity header of the outgoing INVITE; the header also references the certificate retrieval URL (info parameter) so the verification service (VS) can fetch the cert.
On the terminating side, deploy or integrate a verification service that fetches the certificate from the URL in the Identity header, validates the JWS signature, checks the PASSporT claims (origid, iat, orig, dest), and optionally sets a display label based on attestation level.
Test your implementation by calling a number that displays a STIR/SHAKEN result (e.g., many mobile carrier subscribers see a 'Verified' indicator); use a SIP trace tool to inspect the Identity header on the wire.
Known gotchas
PASSporT tokens include an iat (issued-at) timestamp and are valid only within a short window (typically a few seconds); clock skew between your AS and the verification service causes signature rejection.
The certificate retrieval URL in the Identity header must be publicly reachable via HTTPS; certificates behind VPNs or private networks cause verification failures on the terminating carrier side.
Gateway attestation (C) provides the weakest assurance and may still result in calls being labeled as 'potential spam' by some carriers; aim for Full (A) attestation wherever number ownership can be confirmed.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp