Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"78fa6059619f8697c57077b7ab2f271829e8faea1276a19a64b2894f34989850","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_ygXeEbkukxKi","signedAt":"2026-06-08 05:54:55"}
Action payload hash · SHA-256 of the canonical action payload
78fa6059619f8697c57077b7ab2f271829e8faea1276a19a64b2894f34989850
Server signature · HMAC-SHA256 over canonical JSON above
e65560405fd90b739f05d4f4fb0e0126f088bf01017f6d947cb2809da0d3996f
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"78fa6059619f8697c57077b7ab2f271829e8faea1276a19a64b2894f34989850","actionTitle":"FIFA 2026 ticket purchase · USA vs Brazil · Cat 1 · Verified Fan","actionType":"ticket_purchase","actorHandle":"demo","externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_ygXeEbkukxKi","signedAt":"2026-06-08 05:54:55"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: e65560405fd90b739f05d4f4fb0e0126f088bf01017f6d947cb2809da0d3996f