SendGrid Event Webhook signature verification failures

TL;DR

Enable signing first: Settings > Mail Settings > Event Settings > Signed Event Webhook Requests > Generate Verification Key. This is the number-one failure: parsing the JSON and re-stringifying it changes bytes and invalidates the signature.

Steps

1. Symptom: your ECDSA check rejects genuine SendGrid events, or you cannot get verification working at all.
2. Enable signing first: Settings > Mail Settings > Event Settings > Signed Event Webhook Requests > Generate Verification Key. No key, no signature headers.
3. Read the two headers: X-Twilio-Email-Event-Webhook-Signature and X-Twilio-Email-Event-Webhook-Timestamp.
4. Hash sha256 over the timestamp bytes followed by the RAW payload bytes. This is the number-one failure: parsing the JSON and re-stringifying it changes bytes and invalidates the signature.
5. Base64-decode the signature, ASN.1 unmarshal into the {r, s} pair, and ECDSA-verify against the public key.
6. Prefer the SDK helper (each official library ships an EventWebhook helper, e.g. the eventwebhook package) over hand-rolled crypto.
7. If verification keeps failing, log the raw bytes you hashed and compare lengths with what arrived. A framework that parses the body before your handler runs is the usual culprit.

When to use

You are seeing this: Symptom: your ECDSA check rejects genuine SendGrid events, or you cannot get verification working at all. Use this skill when you run into "SendGrid Event Webhook signature verification failures".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The official Event Webhook security doc: Twilio signs with an ECDSA key pair; the signature arrives in X-Twilio-Email-Event-Webhook-Signature and the timestamp in X-Twilio-Email-Event-Webhook-Timestamp. Verification: base64-decode the signature, ASN.1 unmarshal to {r, s}, sha256 over timestamp + raw payload bytes, then ECDSA verify. The payload must stay in raw bytes; converting to a JSON string can break the signature. SDKs ship EventWebhook helpers. Sources: https://github.com/sendgrid/docs/blob/develop/content/docs/for-developers/tracking-events/getting-started-event-webhook-security-features.md