Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"c593ac8f4d2c5c08590f75d08ce08dcc2c7fe8891505850a849b445303848867","actionTitle":"Face verification · arivu","actionType":"verify_identity","actorHandle":"arivu","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_9Xmx80mpGUCb","signedAt":"2026-06-06 11:56:32"}
Action payload hash · SHA-256 of the canonical action payload
c593ac8f4d2c5c08590f75d08ce08dcc2c7fe8891505850a849b445303848867
Server signature · HMAC-SHA256 over canonical JSON above
575e75eb5a1dfc65c261c28e3fa606cf15cdab4249d6da64d369b8bde29601bd
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"c593ac8f4d2c5c08590f75d08ce08dcc2c7fe8891505850a849b445303848867","actionTitle":"Face verification · arivu","actionType":"verify_identity","actorHandle":"arivu","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_9Xmx80mpGUCb","signedAt":"2026-06-06 11:56:32"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 575e75eb5a1dfc65c261c28e3fa606cf15cdab4249d6da64d369b8bde29601bd