---
title: "Circle Wallet Created Webhook"
method: POST
path: "/webhooks/circle/wallet-created"
tags: ["embedder-wallets"]
---

# Circle Wallet Created Webhook

`POST /webhooks/circle/wallet-created`

## Request

- Base URL: `https://api.storyflo.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.storyflo.com/webhooks/circle/wallet-created`
- Auth: none declared

Public Circle ``wallets.created`` webhook.

Signature verification uses the RSA-PKCS1v15-SHA256 helper in
``app.circle_mint`` (matches Circle's documented webhook security
scheme — they sign with their private key, we verify with their
published public key). The task spec said "HMAC" but Circle's real
webhook model is RSA; we use the established verify helper rather
than implementing a parallel HMAC path that would break the first
real Circle ping.

Headers expected
----------------
``X-Circle-Signature``  — base64 RSA-PKCS1v15-SHA256 over the raw body
``X-Circle-Key-Id``     — Circle public key identifier (used to fetch
                           the PEM from /v2/notifications/publicKey)

On signature mismatch returns 401. On unparseable body returns 400.
On any successful match dispatches to
``circle_embedder_wallets.handle_provision_webhook`` for the actual
DB write.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/storyflo/apis/storyflo-inference-router.md) · [All operations](https://skmtc.dev/storyflo/apis/storyflo-inference-router/llms.txt) · [OpenAPI document](https://skmtc.dev/storyflo/apis/storyflo-inference-router/revisions/c3a1a735ac7a?raw)