and I thought there was a specific api for verifying.... I may be wrong! It would make sense for them to have a hands-off symmetrical API for that, so that as a developer you didn't have to know anything about the underlying hashing