Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"d5b2e49329b03b7f23424f15c511e94e399334dbb6ec768d7bec6e35d07a4fdc","actionTitle":"Work session approved · acme corp","actionType":"work_session","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_8nAsns2H2CbB","signedAt":"2026-06-02 13:24:47"}
Action payload hash · SHA-256 of the canonical action payload
d5b2e49329b03b7f23424f15c511e94e399334dbb6ec768d7bec6e35d07a4fdc
Server signature · HMAC-SHA256 over canonical JSON above
e5c517a7114c5dfd6636e5c328c4c6a9e8bfaccfaae0cb418e439044b6e69fc2
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"d5b2e49329b03b7f23424f15c511e94e399334dbb6ec768d7bec6e35d07a4fdc","actionTitle":"Work session approved · acme corp","actionType":"work_session","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_8nAsns2H2CbB","signedAt":"2026-06-02 13:24:47"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: e5c517a7114c5dfd6636e5c328c4c6a9e8bfaccfaae0cb418e439044b6e69fc2