Stop unverified merges. Every PR, prove it's really you.
A GitHub commit status check blocks every pull request to main until the author
verifies their real-world identity with their Manav passkey. No badge, no merge.
STEP 01
PR opened on GitHub
GitHub fires a webhook to this lab. A pending status check is instantly set on the commit SHA — blocking the merge button.
STEP 02
Author verifies identity
The status check links to this lab's verify page. The developer signs in with their Manav passkey — passkey, no password.
STEP 03
Merge unblocked
On success, the GitHub status check flips to success. The PR shows a green check and teammates can merge.
Setup
✓ configured
Register the webhook URL in your GitHub repository, then paste your token and secret below to activate.
https://manav.id/labs/signed_code/webhook/
Go to your GitHub repo → Settings → Webhooks → Add webhook
Paste the URL above into Payload URL. Set Content type to application/json.
Enter the webhook secret you'll set below into Secret.
Under Events choose Let me select individual events → check Pull requests only.
Create a GitHub Personal Access Token (classic) with repo:status scope (or a Fine-grained token with Commit statuses: Write on this repo).
PAT with repo:status scope — never shared, stored only on this server
Must match the secret you enter in GitHub's webhook settings above
manav.id
/
Labs
/
Code Signing