CircleCI Webhooks

CircleCI (circleci.com) is a CI/CD platform. Its outbound webhooks POST JSON to your endpoint when a workflow or a job reaches a terminal state.

Not Circle. Circle (circle.com) is the USDC / Circle Payments Network / Circle Mint payments company. It signs with ECDSA and an X-Circle-Signature header. CircleCI signs with HMAC-SHA256 and a circleci-signature header. Two unrelated companies, two entirely different schemes — never mix their headers or events.

Not CircleCI custom webhooks. Those go the opposite direction: a third party POSTs to CircleCI to trigger a pipeline (docs). This skill is about CircleCI POSTing to you.

The signing secret is not your CircleCI API token. Circle-Token authenticates you calling CircleCI's API. The webhook "Secret token" (API field signing-secret) verifies CircleCI calling you.