Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"871c2e6fe9facd1d007250a74c510b899f074a0504b79f5897114fb04aa4e99d","actionTitle":"Review submission · verified purchase · Acme Wireless Headphones · Arivu","actionType":"review_submit","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_y8UJ2BWAIYCa","signedAt":"2026-06-03 08:02:54"}
Action payload hash · SHA-256 of the canonical action payload
871c2e6fe9facd1d007250a74c510b899f074a0504b79f5897114fb04aa4e99d
Server signature · HMAC-SHA256 over canonical JSON above
45d261d8c578efaf2bca1dc562ced5d9d7444ca8bb220cb496eef4bffde089ac
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"871c2e6fe9facd1d007250a74c510b899f074a0504b79f5897114fb04aa4e99d","actionTitle":"Review submission · verified purchase · Acme Wireless Headphones · Arivu","actionType":"review_submit","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_y8UJ2BWAIYCa","signedAt":"2026-06-03 08:02:54"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 45d261d8c578efaf2bca1dc562ced5d9d7444ca8bb220cb496eef4bffde089ac