Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"37e9f83eb5438454d305987cd3afadf1db2291e2ff2f7c068878058ab509cd0b","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_MHVOvVRI1B-X","signedAt":"2026-08-20 09:57:03"}
Action payload hash · SHA-256 of the canonical action payload
37e9f83eb5438454d305987cd3afadf1db2291e2ff2f7c068878058ab509cd0b
Server signature · HMAC-SHA256 over canonical JSON above
78b2972ae82a24c995452ff5418bbcf8428f966d40bbfc57a92bcebe9d5fbce2
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"37e9f83eb5438454d305987cd3afadf1db2291e2ff2f7c068878058ab509cd0b","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_MHVOvVRI1B-X","signedAt":"2026-08-20 09:57:03"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 78b2972ae82a24c995452ff5418bbcf8428f966d40bbfc57a92bcebe9d5fbce2