Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"0d1cc88d3f5d7a2dbb3f04d3b73638622dad3c1a46ed4428c053033c2b3c9d61","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_MzYin3gLOSkv","signedAt":"2026-06-08 05:23:45"}
Action payload hash · SHA-256 of the canonical action payload
0d1cc88d3f5d7a2dbb3f04d3b73638622dad3c1a46ed4428c053033c2b3c9d61
Server signature · HMAC-SHA256 over canonical JSON above
764372c9c5f428b9b18623e4b36c1705df8ddbbaba4da2f003de0dd207436351
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"0d1cc88d3f5d7a2dbb3f04d3b73638622dad3c1a46ed4428c053033c2b3c9d61","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_MzYin3gLOSkv","signedAt":"2026-06-08 05:23:45"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 764372c9c5f428b9b18623e4b36c1705df8ddbbaba4da2f003de0dd207436351