Sendgrid Webhooks

Handles SendGrid webhook verification and event processing, which is trickier than most webhook implementations because it uses ECDSA signature verification instead of simple HMAC. You get manual verification code and SDK examples for validating those X-Twilio-Email-Event-Webhook headers, plus a reference table of all the event types (delivered, bounce, open, click, spam report). The verification.md doc is worth reading since ECDSA has gotchas around key formatting. Built by Hookdeck, so it includes their CLI for local testing. Useful if you're building email engagement tracking or need to debug why signatures keep failing.

skills.sh installs: 253
GitHub stars: 100
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add hookdeck/webhook-skills --skill sendgrid-webhooks --agent claude-code

Installs into .claude/skills of the current project.

Files

SendGrid Webhooks

When to Use This Skill

Setting up SendGrid webhook handlers for email delivery tracking
Debugging ECDSA signature verification failures
Processing email events (bounce, delivered, open, click, spam report)
Implementing email engagement analytics

Essential Code

Signature Verification (Manual)

SendGrid uses ECDSA (Elliptic Curve Digital Signature Algorithm) with public key verification.

// Node.js manual verification
const crypto = require('crypto');

function verifySignature(publicKey, payload, signature, timestamp) {
  // Decode the base64 signature
  const decodedSignature = Buffer.from(signature, 'base64');

  // Create the signed content
  const signedContent = timestamp + payload;

  // Create verifier
  const verifier = crypto.createVerify('sha256');
  verifier.update(signedContent);

  // Add PEM headers if not present
  let pemKey = publicKey;
  if (!pemKey.includes('BEGIN PUBLIC KEY')) {
    pemKey = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`;
  }

  // Verify the signature
  return verifier.verify(pemKey, decodedSignature);
}

SKILL.md on GitHub