Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"2d5fc08b45844e730a907ab64d5bdce0af6860c3e4d91dd38c5311684fed7912","actionTitle":"Face verification · arivu","actionType":"verify_identity","actorHandle":"arivu","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_KIWePOQD22L1","signedAt":"2026-06-06 02:17:54"}
Action payload hash · SHA-256 of the canonical action payload
2d5fc08b45844e730a907ab64d5bdce0af6860c3e4d91dd38c5311684fed7912
Server signature · HMAC-SHA256 over canonical JSON above
738c7816864cc0e1c243253ae245276c6eab23312c89ec4df640ee5a4aff408b
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"2d5fc08b45844e730a907ab64d5bdce0af6860c3e4d91dd38c5311684fed7912","actionTitle":"Face verification · arivu","actionType":"verify_identity","actorHandle":"arivu","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_KIWePOQD22L1","signedAt":"2026-06-06 02:17:54"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 738c7816864cc0e1c243253ae245276c6eab23312c89ec4df640ee5a4aff408b