Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"eaca2899353bb091c3ac7eaca1a077fe138afa2467a8be678758d81944741655","actionTitle":"Work session approved · Vishal Kumar","actionType":"work_session","actorHandle":"vishaltao_2ea02f","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_2SCsLjJtEz1S","signedAt":"2026-06-02 14:08:30"}
Action payload hash · SHA-256 of the canonical action payload
eaca2899353bb091c3ac7eaca1a077fe138afa2467a8be678758d81944741655
Server signature · HMAC-SHA256 over canonical JSON above
5fdc2675b487343219dd0e6b19134689776c105ebc90852e3b535ae165ee08b8
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"eaca2899353bb091c3ac7eaca1a077fe138afa2467a8be678758d81944741655","actionTitle":"Work session approved · Vishal Kumar","actionType":"work_session","actorHandle":"vishaltao_2ea02f","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_2SCsLjJtEz1S","signedAt":"2026-06-02 14:08:30"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 5fdc2675b487343219dd0e6b19134689776c105ebc90852e3b535ae165ee08b8