Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"dd4e2534887eb367b406a7e22896c0e752b7633742951af2f8c02d7a9e2b76f8","actionTitle":"Face verification · arivu","actionType":"verify_identity","actorHandle":"arivu","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_UkQ_hNzni8yO","signedAt":"2026-06-06 02:00:51"}
Action payload hash · SHA-256 of the canonical action payload
dd4e2534887eb367b406a7e22896c0e752b7633742951af2f8c02d7a9e2b76f8
Server signature · HMAC-SHA256 over canonical JSON above
120d25ccc5238355de456bdf3a039ca2b56b11ea2be34c911ec4e40924471642
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"dd4e2534887eb367b406a7e22896c0e752b7633742951af2f8c02d7a9e2b76f8","actionTitle":"Face verification · arivu","actionType":"verify_identity","actorHandle":"arivu","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_UkQ_hNzni8yO","signedAt":"2026-06-06 02:00:51"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 120d25ccc5238355de456bdf3a039ca2b56b11ea2be34c911ec4e40924471642