Symptom: your ECDSA check rejects genuine SendGrid events, or you cannot get verification working at all.
1. Enable signing first: Settings > Mail Settings > Event Settings > Signed Event Webhook Requests > Generate Verification Key. No key, no signature headers.
2. Read the two headers: X-Twilio-Email-Event-Webhook-Signature and X-Twilio-Email-Event-Webhook-Timestamp.
3. Hash sha256 over the timestamp bytes followed by the RAW payload bytes. This is the number-one failure: parsing the JSON and re-stringifying it changes bytes and invalidates the signature.
4. Base64-decode the signature, ASN.1 unmarshal into the {r, s} pair, and ECDSA-verify against the public key.
5. Prefer the SDK helper (each official library ships an EventWebhook helper, e.g. the eventwebhook package) over hand-rolled crypto.
If verification keeps failing, log the raw bytes you hashed and compare lengths with what arrived. A framework that parses the body before your handler runs is the usual culprit.