Verify SendGrid webhooks

​

Get the public verification key

​

Register it on your endpoint

# read from a no-echo prompt (or piped stdin) — never an argv flag
printf %s "$SENDGRID_PUBLIC_KEY" | wbhk endpoints add-provider-secret <endpoint-id> \
  --provider sendgrid

curl https://api.webhook.co/v1/endpoints/<endpoint-id>/provider-secrets \
  -H "Authorization: Bearer $WEBHOOK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"provider":"sendgrid","secret":"<your-value>"}'

await webhook.endpoints.providerSecrets.add({
  endpointId,
  provider: "sendgrid",
  secret: process.env.SENDGRID_PUBLIC_KEY!,
});

​

How the signature is checked

• Signed message — {timestamp}{rawBody} — the …-Timestamp header concatenated to the raw body.
• Algorithm — ECDSA (P-256, SHA-256), base64-encoded.
• Key — registered secret is the dashboard “Verification Key” — base64 of the SPKI DER ECDSA P-256 public key.
• Signature format — base64-encoded DER ECDSA signature (converted to IEEE-P1363 r||s for WebCrypto).
• Timestamp — read from the x-twilio-email-event-webhook-timestamp header.

​

What makes this one different

• The registered “secret” is SendGrid’s base64 SPKI ECDSA P-256 PUBLIC key (“Verification Key”), not a shared secret.
• The DER-encoded ECDSA signature is converted to IEEE-P1363 raw r||s (64 bytes) before WebCrypto verify.
• The signed timestamp is bound into the message but no replay window is enforced.

​

Confirm

wbhk events list <endpoint-id> --status verified