How to Test SendGrid Webhooks

SendGrid sends Event Webhooks for email delivery events — delivered, opened, clicked, bounced, and spam reports.

Looking for the broader picture? See the 7 best webhook testing tools (2026), or if you're already on Webhook.site, the 60-second migration to HookRay.

1. SendGrid Webhook Events

SendGrid can send the following webhook events to your endpoint:

2. Set Up a Test Endpoint with HookRay

Follow these steps to start receiving SendGrid webhooks for testing:

1. Go to HookRay and click "Start Testing — Free" to get your unique webhook URL.
2. Copy the URL (e.g., https://h.hookray.com/abc123).
3. In your SendGrid dashboard, navigate to the webhook settings and paste the HookRay URL as your endpoint.
4. Select the events you want to receive (see list above).
5. Trigger a test event — HookRay will show the incoming webhook in real-time.

3. Sample SendGrid Webhook Payload

Here's an example of what a SendGrid webhook payload looks like:

{
  "email": "user@example.com",
  "event": "delivered",
  "sg_message_id": "abc123.filter0001.12345",
  "timestamp": 1710000000,
  "category": [
    "marketing"
  ]
}

4. How to Verify SendGrid Webhook Signatures

Node.js (Express)

// npm i @sendgrid/eventwebhook
import { EventWebhook } from '@sendgrid/eventwebhook';
import express from 'express';

const ew = new EventWebhook();
const PUBLIC_KEY = process.env.SENDGRID_WEBHOOK_PUBLIC_KEY!;
const ecPublicKey = ew.convertPublicKeyToECDSA(PUBLIC_KEY);

const app = express();

app.post(
  '/webhooks/sendgrid',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature =
      (req.headers['x-twilio-email-event-webhook-signature'] as string | undefined) ?? '';
    const timestamp =
      (req.headers['x-twilio-email-event-webhook-timestamp'] as string | undefined) ?? '';

    const isValid = ew.verifySignature(
      ecPublicKey,
      req.body, // raw Buffer
      signature,
      timestamp,
    );

    if (!isValid) return res.status(403).send('invalid signature');

    const events = JSON.parse(req.body.toString('utf8')); // array of events
    res.json({ ok: true, count: events.length });
  },
);

Python (FastAPI)

# pip install sendgrid
import os
from sendgrid.helpers.eventwebhook import EventWebhook, EventWebhookHeader
from fastapi import FastAPI, Request, HTTPException

ew = EventWebhook()
public_key = ew.convert_public_key_to_ecdsa(
    os.environ['SENDGRID_WEBHOOK_PUBLIC_KEY']
)
app = FastAPI()

@app.post("/webhooks/sendgrid")
async def sendgrid_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get(EventWebhookHeader.SIGNATURE.lower(), '')
    timestamp = request.headers.get(EventWebhookHeader.TIMESTAMP.lower(), '')
    if not ew.verify_signature(public_key, body.decode(), signature, timestamp):
        raise HTTPException(status_code=403, detail='invalid signature')
    return {'ok': True}

Capture a real SendGrid webhook with HookRay first, then replay the captured request against your verifier locally — that way you can iterate on the verification code without re-triggering events in SendGrid. Read SendGrid's official signing docs for the canonical reference, or see the cross-service signature verification guide for Ruby and timing-safe comparison patterns.

5. How SendGrid Retries Failed Webhooks

If your handler is going to see the same SendGrid event multiple times, you need idempotency by event ID and the right response codes — see the Webhook Retry Strategies guide for the full pattern (idempotency tables, dead-letter queues, replaying captured events for tests). Cross-reference with SendGrid's official retry docs before relying on these numbers in production.

6. Frequently Asked Questions

7. Next Steps

• Use HookRay's webhook replay feature to re-send captured webhooks while building your handler
• Enable smart parsing (Pro plan) to see SendGrid-specific fields highlighted automatically
• Check the SendGrid webhook documentation for the complete event reference