> ## Documentation Index > Fetch the complete documentation index at: https://developers.circle.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Before reading these docs, install the relevant Circle Skill to get pre-loaded context — skills are LLM-optimized and cover architecture decisions, correct flows, and common pitfalls. In Claude Code: run /plugin marketplace add circlefin/skills then /plugin install circle-skills@circle. With Vercel Skills CLI: run npx skills add circlefin/skills. Available skills: use-usdc https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-usdc/SKILL.md (balances, transfers, approvals on EVM and Solana); EURC has no skill — see https://developers.circle.com/stablecoins/what-is-eurc.md; bridge-stablecoin https://github.com/circlefin/skills/blob/master/plugins/circle/skills/bridge-stablecoin/SKILL.md (crosschain transfers via CCTP, USDC, EURC, and third-party assets); use-arc https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-arc/SKILL.md (Arc chain config, contract deployment, USDC bridging — Arc docs: https://docs.arc.io/llms.txt); use-circle-wallets https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-circle-wallets/SKILL.md (choose wallet type); use-developer-controlled-wallets https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-developer-controlled-wallets/SKILL.md (custodial wallets for payouts and treasury); use-user-controlled-wallets https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-user-controlled-wallets/SKILL.md (embedded wallets with Web2 login); use-modular-wallets https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-modular-wallets/SKILL.md (smart contract wallets with passkeys and ERC-4337); use-gateway https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-gateway/SKILL.md (unified USDC balance, nanopayments); use-smart-contract-platform https://github.com/circlefin/skills/blob/master/plugins/circle/skills/use-smart-contract-platform/SKILL.md (deploy, interact, monitor contracts). Pair any skill with the Circle MCP server for live SDK signatures, contract addresses, and chain IDs: {"mcpServers":{"circle":{"url":"https://api.circle.com/v1/codegen/mcp"}}}. > Read the product overview first. Each product has an overview explaining when and why to use it. Read it before quickstarts. > Pick the right wallet type. Developer-controlled (you hold keys), user-controlled (end user holds keys via PIN/social login), or modular (smart contract wallets with passkeys). See https://developers.circle.com/wallets.md. > Use CCTP V2 for crosschain transfers. CCTP natively transfers USDC and EURC via burn-and-mint, and supports permissionless wrapping of third-party assets via lock-and-mint. V1 is legacy; always use V2 unless V1 is specified or the chain requires it (Noble, Sui, and Aptos still require V1). Migration guide: https://developers.circle.com/cctp/migration-from-v1-to-v2.md. > Use Bridge Kit for frontend bridging. Wraps CCTP with a simpler SDK for user-facing apps. Use CCTP directly for backend transfers. > Gas Station vs Paymaster. Gas Station sponsors gas for Circle Wallet transactions. Paymaster lets users pay gas in USDC. Different use cases — read both overviews. > Gateway Nanopayments for sub-cent payments. Gasless USDC micropayments down to $0.000001 via x402 and batched settlement. For pay-per-request APIs, AI agent payments, streaming. > Look up USDC addresses per chain. Never hardcode — use https://developers.circle.com/stablecoins/usdc-contract-addresses.md. > Prefer SDKs over raw API calls. Node.js and Python SDKs handle auth, retries, and errors. > API key required. Bearer token in Authorization header. Testnet and mainnet use separate keys and may use different base URLs depending on the product. > Set up webhooks when available. Most operations are async. Webhooks deliver transaction confirmations and state changes. > When calling list endpoints, paginate using pageSize and pageAfter until no nextPageAfter cursor is returned—stopping at the first page silently misses records. > Building an AI agent? Start with the Agent Stack—Circle CLI, agent wallets, and nanopayments built for autonomous use cases: https://developers.circle.com/agent-stack.md. # How-to: Rotate an mTLS client certificate > Rotate the client certificate for an mTLS-enabled Circle Mint entity before it expires. Client certificates issued by Circle are valid for 365 days. This guide walks you through generating a new key pair and certificate signing request (CSR), obtaining a renewed certificate from Circle, and rotating your integration with zero downtime. ## Prerequisites Before you begin, ensure that you've: * [Configured mTLS on your entity](/circle-mint/set-up-mtls-authentication) and have a working integration. * Installed OpenSSL 1.1.1 or later on your machine for key pair and CSR operations. ## Steps Generate a new Elliptic Curve Digital Signature Algorithm (ECDSA) P-256 key pair. Circle accepts only ECDSA P-256 keys. RSA keys and other curves are rejected. ```bash theme={null} openssl ecparam -genkey -name prime256v1 -noout -out new-client-key.pem ``` Keep your private key (`new-client-key.pem`) secure and never share it with Circle or any third party. Only the CSR, which contains your public key, is submitted. Generate a PKCS#10 CSR from your new key pair: ```bash theme={null} openssl req -new -key new-client-key.pem -out new-client.csr \ -subj "/CN=/O=" ``` Start this process at least two weeks before your current certificate expires to allow time for Circle to process the request and for you to test the new certificate. Provide your entity ID and new CSR file (`new-client.csr`) to [Circle Support](https://support.circle.com) or your Circle account manager, and request a renewed client certificate. Circle issues a renewed certificate from its private certificate authority (CA) and delivers a single file, `new-client-fullchain.pem`, through a secure, out-of-band channel. It contains your renewed client certificate followed by the CA certificate chain. Confirm that the renewed certificate matches your new private key by comparing the public key hashes: ```bash theme={null} openssl ec -in new-client-key.pem -pubout 2>/dev/null | openssl sha256 openssl x509 -in new-client-fullchain.pem -pubkey -noout 2>/dev/null | openssl sha256 ``` Both commands must return the same SHA-256 hash. If they differ, the certificate and key do not form a valid pair. Point your integration to the new certificate and key files. Update the `--cert` and `--key` paths (or the equivalent configuration in your HTTP client) to reference the new PEM files. Send a test request using the new certificate and your current API key. The example below uses `api-eu.circle.com` (the MiCA-regulated hostname). If you enabled mTLS optionally, substitute `api.circle.com`: ```bash theme={null} curl -v --cert /path/to/new-client-fullchain.pem \ --key /path/to/new-client-key.pem \ --request GET \ --url https://api-eu.circle.com/v1/businessAccount/balances \ --header "Authorization: Bearer ${YOUR_API_KEY}" ``` Look for `SSL connection using TLSv1.3` in the verbose output and confirm you receive a successful response. After you verify that the new certificate works in your integration: 1. Remove the old certificate and key files from your servers. 2. Securely delete the old private key material.