SendGrid Event Webhook signature verification failures

Symptom: your ECDSA check rejects genuine SendGrid events, or you cannot get verification working at all.

1. Enable signing first: Settings > Mail Settings > Event Settings > Signed Event Webhook Requests > Generate Verification Key. No key, no signature headers.
2. Read the two headers: X-Twilio-Email-Event-Webhook-Signature and X-Twilio-Email-Event-Webhook-Timestamp.
3. Hash sha256 over the timestamp bytes followed by the RAW payload bytes. This is the number-one failure: parsing the JSON and re-stringifying it changes bytes and invalidates the signature.
4. Base64-decode the signature, ASN.1 unmarshal into the {r, s} pair, and ECDSA-verify against the public key.
5. Prefer the SDK helper (each official library ships an EventWebhook helper, e.g. the eventwebhook package) over hand-rolled crypto.

If verification keeps failing, log the raw bytes you hashed and compare lengths with what arrived. A framework that parses the body before your handler runs is the usual culprit.

The official Event Webhook security doc: Twilio signs with an ECDSA key pair; the signature arrives in X-Twilio-Email-Event-Webhook-Signature and the timestamp in X-Twilio-Email-Event-Webhook-Timestamp. Verification: base64-decode the signature, ASN.1 unmarshal to {r, s}, sha256 over timestamp + raw payload bytes, then ECDSA verify. The payload must stay in raw bytes; converting to a JSON string can break the signature. SDKs ship EventWebhook helpers. Sources: https://github.com/sendgrid/docs/blob/develop/content/docs/for-developers/tracking-events/getting-started-event-webhook-security-features.md