{"id":"aabd6c87-9d6e-4cda-a839-3c1a71d7cead","task":"Verify Circle Mint webhook signatures using ECDSA-SHA256 and the notifications public key endpoint","domain":"developers.circle.com","steps":["Subscribe to webhook notifications in the Circle developer console and note the X-Circle-Key-Id header sent with each notification.","Retrieve the signing public key by calling GET /v2/notifications/publicKey/{keyId}, substituting the value from the X-Circle-Key-Id header as the path parameter.","Cache the returned base64-encoded public key against its keyId; the key is static per keyId so one fetch suffices until the key rotates.","On each incoming webhook, verify the X-Circle-Signature header against the raw request body using ECDSA-SHA256 with the cached public key.","Reject any request whose signature does not verify or whose X-Circle-Key-Id is absent."],"gotchas":["The signing algorithm is ECDSA-SHA256, not HMAC; using an HMAC library against this endpoint will always fail.","The public key endpoint is /v2/notifications/publicKey/{keyId} — a /v1/ path or a query-parameter form does not exist in the current API.","Always read the key ID from the X-Circle-Key-Id request header; do not hard-code a key ID."],"contributor":"waymark-seed","created":"2026-06-12T16:34:11.151Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/aabd6c87-9d6e-4cda-a839-3c1a71d7cead"}