One check between your portal and your payment hub.
Keep your login MFA, core and callback desk. Single signer or dual control: a clerk initiates, the CFO signs.
- Your portalAsks for approval on the exact wire fields.
- Approver's phoneShows the full payee. Passkey tap (Face ID, fingerprint or PIN).
- Manav receiptEd25519 signature over the canonical wire fields.
- Your gate, in your VPCChecks the receipt offline against the order. Single-use wire ID.
- Payment hubFedwire, RTP or ACH release, as today.
About 20 lines of code.
Portal: ask for the signature
// The approver's phone shows these exact fields
const receipt = await Manav.sign({
action: "wire.release",
wire_id: "fw_2026_8841a",
amount: "480000.00",
beneficiary_name: "Meridian Properties",
routing_aba: "021000021",
account_num: "44718821"
});
await fetch("/api/wires/release", {
method: "POST",
headers: { "X-Manav-Receipt": receipt.token }
});
Gate: check before release
// Ed25519 check against the cached public key. // No network call to Manav. const ok = ManavGate.verify(req.headers["x-manav-receipt"], { action: "wire.release", wire_id: req.body.wire_id, amount: req.body.amount, beneficiary_name: req.body.beneficiary_name, routing_aba: req.body.routing_aba, account_num: req.body.account_num }); if (!ok) return res.status(428).json({ error: "HOLD" });
What sits where.
What Manav storesPublic keys, signer IDs and payload hashes. No balances, SSNs or biometrics. Receipts with account data stay in your audit log. DPA
Verification is localYour gate verifies in your VPC with no call to Manav. If signing is unavailable, wires fall back to your callback desk.
Same SDK, three gatesWire release, beneficiary changes and new signer enrollment.
Standards, not new crypto.
W3C WebAuthn / FIDO2Passkeys on current iOS and Android. Approve in an app or in the browser with a QR code.
Ed25519 (RFC 8032)Receipt signatures. Keys published as JWKS for rotation.
Dynamic linkingModeled on PSD2 RTS Art. 5 (EU, since 2019): the approval is bound to the amount and payee.
No lock-inArchived receipts verify with OpenSSL 3 or any Ed25519 library.
Threat model and limits.
What the gate proves, and what it does not. The approver's WebAuthn assertion is bound to the canonical wire digest; Manav then issues the Ed25519 receipt your gate checks. Last reviewed: October 2026.
Deceived approverOut of scope for any signature. If an approver is talked into approving the wrong payee, they sign it. The phone shows full payee, routing, account and amount before the tap.
Compromised phone OSA phone OS that can both alter the screen and drive the passkey is outside what a signature proves. Pair with your MDM or device policy for treasury approvers.
Lost phone, re-enrollmentEnrolling a new signer is itself a gated action, signed by an existing signer or approved by your treasury admin. No self-service reset. Recommended: require an existing signer.
Callback fallbackNo phone means your callback desk handles the wire, as today. It is the weak link, so the pilot reports how often it is used.
Receipt signing keyWhoever holds Manav's signing key could issue receipts. Today that key is the trust anchor at your gate. Pin the key ID and follow published rotation.
Walk your security team through it.
20 minutes with an engineer, using your own wire flow.