Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"30cb642418f18cbbf63b117478dc1c91e9c3a5fdbbabe1c46d05d735b1bf2465","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_1RImBCn2a17X","signedAt":"2026-06-08 06:07:11"}
Action payload hash · SHA-256 of the canonical action payload
30cb642418f18cbbf63b117478dc1c91e9c3a5fdbbabe1c46d05d735b1bf2465
Server signature · HMAC-SHA256 over canonical JSON above
d481c62f9457c4d16be38f0d85d88bafcb35bad2bd1fb03d986feead8e653bf0
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"30cb642418f18cbbf63b117478dc1c91e9c3a5fdbbabe1c46d05d735b1bf2465","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_1RImBCn2a17X","signedAt":"2026-06-08 06:07:11"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: d481c62f9457c4d16be38f0d85d88bafcb35bad2bd1fb03d986feead8e653bf0