Delivery behaviour
Read from the vendor's own documentation, last checked 2026-08-06. Where the vendor states no number, this table carries none.
| Response budget | not published by the vendor |
|---|---|
| Retry | not published by the vendor |
| Gives up | not published by the vendor |
Signature
Verified against a working verifier proven by a test suite, not read from documentation. Last verified 2026-08-20.
| Algorithm | ECDSA P-256 |
|---|---|
| Signed payload | {timestamp}{body} |
| Encoding | base64 |
| Header | x-twilio-email-event-webhook-signature |
| Tolerance | none enforced |
Verify it
The raw request body, byte for byte, before any JSON parsing. Every scheme on this page breaks the moment a framework re-serializes the payload.
// ECDSA P-256 over "{timestamp}{body}", signature and key both base64.
const b64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
const key = await crypto.subtle.importKey(
"spki",
b64(verificationKey), // Mail Settings → Signed Event Webhook
{ name: "ECDSA", namedCurve: "P-256" },
false,
["verify"],
);
const ts = req.headers["x-twilio-email-event-webhook-timestamp"];
const valid = await crypto.subtle.verify(
{ name: "ECDSA", hash: "SHA-256" },
key,
b64(req.headers["x-twilio-email-event-webhook-signature"]),
new TextEncoder().encode(ts + rawBody),
);What bites
The headers say x-twilio-email because Twilio owns SendGrid; the scheme is SendGrid's own and shares nothing with Twilio's HMAC-SHA1. A verifier keyed on the header prefix alone picks the wrong algorithm.
Read more
AnyHook sits in front of endpoints that receive from SendGrid: it answers inside the budget above, retries on its own schedule when your server is down, and keeps every event replayable. Change one URL, keep your code.