Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"9f423ace1a926eed4cc59cc854e5a8d860bd2545f4dd7e84d7ae46f058065f4f","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_xoBuB2ctR67m","signedAt":"2026-06-08 05:35:35"}
Action payload hash · SHA-256 of the canonical action payload
9f423ace1a926eed4cc59cc854e5a8d860bd2545f4dd7e84d7ae46f058065f4f
Server signature · HMAC-SHA256 over canonical JSON above
cd1410dfcb042b7f742ba7e465c331e1ac0ebc054977cd1bd61a976af453d004
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"9f423ace1a926eed4cc59cc854e5a8d860bd2545f4dd7e84d7ae46f058065f4f","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_xoBuB2ctR67m","signedAt":"2026-06-08 05:35:35"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: cd1410dfcb042b7f742ba7e465c331e1ac0ebc054977cd1bd61a976af453d004