circle-webhooks
Installation
SKILL.md
Circle Webhooks
When to Use This Skill
- How do I receive Circle webhooks?
- How do I verify Circle webhook signatures (ECDSA /
X-Circle-Signature)? - How do I fetch and cache the Circle notification public key by
X-Circle-Key-Id? - How do I handle
cpn.payment.*,cpn.transaction.*, orcpn.rfi.*notifications? - Why is my Circle webhook signature verification failing?
How Circle Webhooks Differ From Most Providers
Circle's v2 notifications are signed with an asymmetric ECDSA key — not HMAC, and not the Standard Webhooks spec. Each POST carries two headers:
| Header | Purpose |
|---|---|
X-Circle-Signature |
Base64-encoded ECDSA (ECDSA_SHA_256) signature of the raw body |
X-Circle-Key-Id |
UUID of the public key that signed the notification |