this is testing blog

Configurator. This is the central hub for managing the cryptographic relationship between the developer's server and Circle's API.

1. Sidebar -> Wallets: The primary entry point for all wallet infrastructure.
2. Wallets -> Dev-Controlled: The specific sub-set for server-side managed wallets.
3. Dev-Controlled -> Configurator: The configuration screen where registration occurs.
4. Configurator -> Registration Field: A large input box designed to receive the Entity Secret Ciphertext.
5. Configurator -> Register Button: The primary action button that submits the ciphertext to Circle's infrastructure.

The Entity Secret: From Generation to Ciphertext

Understanding the technical composition of the Entity Secret is vital for the successful execution of the registration process. The secret is a 32-byte private key generated by the developer, typically encoded as a 64-character hexadecimal string. It is a unique identifier that acts as the "password" for an application’s wallet operations.

Local Generation Procedures

Generation must take place in an isolated environment to prevent the secret from being logged in transit or stored in vulnerable web history.

• OpenSSL Generation: On a terminal with OpenSSL installed, the command openssl rand -hex 32 will generate a cryptographically secure 256-bit key.
• Node.js Generation: Developers using JavaScript environments can use the built-in crypto module: crypto.randomBytes(32).toString('hex'). The resulting string is static and should be treated with the same level of security as a root password or a private key.

The Encryption Requirement

The Circle API does not accept the raw 32-byte secret. Instead, for every request that requires authorization—such as creating a wallet set—the secret must be transformed into a ciphertext. This transformation involves RSA asymmetric encryption using Circle’s public key.

ComponentDescriptionSourceEntity Secret32-byte hex string (Generated once)Local machine / DeveloperEntity Public KeyRSA Public Key (PEM format)Circle API (publicKey endpoint)CiphertextRSA-OAEP encrypted base64 stringOutput of local encryption script

Technical Implementation: Fetching the Public Key

Before the encryption can proceed, the developer must programmatically or manually fetch the public key associated with their Circle entity. This key is not static across the entire platform; it is unique to the developer's account.

Authentication Prerequisites

To fetch the key, an API key must first be created in the API & Client Keys section of the console. This section is located above the Wallets menu in the left sidebar. When creating the key, developers should select Standard Access for ease of use during initial testing or Restricted Access with permissions specifically granted for Wallets and Developer Account configurations.

The publicKey Endpoint

The public key is retrieved via a GET request to https://api.circle.com/v1/w3s/config/entity/publicKey. The Authorization header must include the full API key (formatted as Bearer PREFIX:ID:SECRET). The response contains a standard RSA public key in PEM format, starting with -----BEGIN RSA PUBLIC KEY-----. This key serves as the cryptographic lock that only Circle can open with their private MPC hardware security modules.

Encryption Logic and Ciphertext Generation

The transformation of the Entity Secret into a ciphertext is a multi-step process that requires adherence to specific cryptographic standards to be accepted by Circle's validators.