SendGrid · api · fg-0415
SendGrid Event Webhook signature verification fails on real deliveries
verifySignature returns false for live events
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
The ECDSA signature covers the timestamp header plus the raw request bytes, including the line breaks SendGrid puts between batched events. Parsing and re-stringifying the JSON changes those bytes.
Fix
Capture the raw body before any JSON middleware and verify against it with the public key from the Event Webhook security settings.
Apply
app.post('/sg-events', express.raw({ type: 'application/json' }), (req, res) => { const ew = new EventWebhook(); const ok = ew.verifySignature(ew.convertPublicKeyToECDSA(PUBLIC_KEY), req.body, req.get('X-Twilio-Email-Event-Webhook-Signature'), req.get('X-Twilio-Email-Event-Webhook-Timestamp')); res.sendStatus(ok ? 200 : 403); });Affects: SendGrid signed Event Webhook, @sendgrid/eventwebhook and sendgrid-python helpers, as of 2026-10
Sources
- https://www.twilio.com/docs/sendgrid/for-developers/tracking-events/getting-started-event-webhook-security-features
- https://github.com/sendgrid/sendgrid-nodejs/issues/1238
- https://github.com/sendgrid/sendgrid-python/issues/950
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp