feat: add Jiminny provider by adamjramirez · Pull Request #5944 · NangoHQ/nango

adamjramirez · 2026-04-25T03:11:44Z

Summary

Adds Jiminny (https://jiminny.com) as a new API_KEY provider.

Auth: Bearer token via Authorization: Bearer ${apiKey}
Regions: EU (app.jiminny.eu) and US (app.jiminny.com) — selectable via connection_config.region
Verification: GET /v1/activities?limit=1 — read-only, returns 200 with empty list for accounts with no calls
Categories: productivity, support

Jiminny is a conversation intelligence platform (call recording, AI summaries, sentiment analysis) used by sales and CS teams.

API reference: https://jiminny.github.io/customer-api-docs/

Note: This PR is submitted on behalf of a customer integration. We have an API key for testing but have not end-to-end validated the verification endpoint against a live tenant — happy to iterate if the Nango team spots issues.

cubic-dev-ai

1 issue found across 1 file

Confidence score: 2/5

There is a concrete security risk in packages/providers/providers.yaml: unvalidated region is used to build the request host, which can redirect authenticated traffic to attacker-controlled domains.
Given the high severity/confidence (7/10, 9/10) and user-impact potential (credential/token exposure or unintended outbound calls), this is not a low-risk merge in its current state.
This should be straightforward to reduce by strict allowlisting/validation of supported regions before host construction.
Pay close attention to packages/providers/providers.yaml - host interpolation from region must be constrained to trusted domains.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/providers/providers.yaml">

<violation number="1" location="packages/providers/providers.yaml:9170">
P1: Unvalidated `region` is interpolated into the request host, allowing authenticated traffic to be sent to an arbitrary domain.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f675f7a56

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Without validation, an arbitrary region value is interpolated directly into the proxy base_url hostname. A pattern allowlist ensures only the two supported TLDs are accepted.

adamjramirez · 2026-04-27T22:11:35Z

Fixed in e7edf7d — added pattern: '^(eu|com)$' to the region field. Nango's connection config validation will now reject any value that isn't eu or com before it can reach the URL construction step.

hassan254-prog

Thanks for the contribution. You’ll need to complete this pr with the relevant docs and logo for the new provider. Please use this example as a reference to create the required docs.

hassan254-prog · 2026-04-28T05:25:37Z

+        - communication
+    auth_mode: API_KEY
+    proxy:
+        base_url: https://app.jiminny.${connectionConfig.region}/customer/api/v1


Suggested change

base_url: https://app.jiminny.${connectionConfig.region}/customer/api/v1

base_url: https://app.jiminny.${connectionConfig.region}/customer/api

The version should be appended to the verification endpoint.

hassan254-prog · 2026-04-28T05:27:04Z

+        apiKey:
+            type: string
+            title: API Key
+            description: Your Jiminny API key. Generate one in Jiminny under Org Settings → General → API Key (requires Admin or Owner role).


Suggested change

description: Your Jiminny API key. Generate one in Jiminny under Org Settings → General → API Key (requires Admin or Owner role).

description: Your Jiminny API key.

The rest should be described in the docs.

hassan254-prog · 2026-04-28T05:27:16Z

+            pattern: '^(eu|com)$'
+            example: eu
+            default_value: com
+            order: 1


Suggested change

order: 1

Adds all required documentation per contributor guidelines: - Quickstart page (api-integrations/jiminny.mdx) - Connect guide explaining region + API key setup - PreBuiltTooling and PreBuiltUseCases snippets - Provider logo SVG - docs.json nav entry - providers.yaml: fix docs URL to api-integrations path, add docs_connect Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Move /v1 from base_url to verification endpoint path - Remove redundant order field from region config - Shorten apiKey description (detail belongs in docs) - Add example JWT and pattern for apiKey field Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

gitguardian · 2026-04-30T03:25:37Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
-	-	JSON Web Token	`dc2cd3a`	packages/providers/providers.yaml	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

hassan254-prog

Few comments otherwise looks good to merge.

hassan254-prog · 2026-05-05T18:22:33Z

+            description: The region your Jiminny account is hosted in (eu for app.jiminny.eu, com for app.jiminny.com)
+            pattern: '^(eu|com)$'
+            example: eu
+            default_value: com


Suggested change

default_value: com

hassan254-prog · 2026-05-05T18:23:22Z


        const res = await nango.get({
-            endpoint: '/api/users/@me',
+            endpoint: '/me',


Suggested change

endpoint: '/me',

endpoint: '/v1/me',

same as the endpoint above.

hassan254-prog · 2026-05-05T18:24:07Z

+2. Select your **Region** (`eu` or `com`) from the dropdown.
+3. Enter your **API Key** in the API Key field.
+4. Submit the form to complete authentication.
+


Would be nice to include the form screenshot here.

I would love to, but we don't actually have access to Jiminny. A potential customer has provided us just with the key and we are using their docs to build the integration directly.

hassan254-prog · 2026-05-05T18:25:19Z

Please fix the broken link.

Co-authored-by: Hassan_Wari <85742599+hassan254-prog@users.noreply.github.com>

- Remove broken docs link in jiminny.mdx (CI mintlify check was failing) - Update quickstart example endpoints /me → /v1/me (curl + Node SDK) - Remove default_value from region connection_config

adamjramirez added 2 commits April 24, 2026 22:11

feat: add Jiminny provider (API_KEY auth)

9f675f7

fix: categories communication, independent order numbering

9c6d1d5

cubic-dev-ai Bot reviewed Apr 25, 2026

View reviewed changes

Comment thread packages/providers/providers.yaml

chatgpt-codex-connector Bot reviewed Apr 25, 2026

View reviewed changes

Comment thread packages/providers/providers.yaml

adamjramirez added 2 commits April 24, 2026 22:22

fix: correct base_url path prefix and verification endpoint

0d05d3a

fix(jiminny): constrain region to eu|com to prevent host injection

e7edf7d

Without validation, an arbitrary region value is interpolated directly into the proxy base_url hostname. A pattern allowlist ensures only the two supported TLDs are accepted.

hassan254-prog reviewed Apr 28, 2026

View reviewed changes

adamjramirez and others added 2 commits April 29, 2026 22:20

TBonnin force-pushed the master branch from d1b1f44 to 3827b88 Compare May 2, 2026 15:55

adamjramirez requested a review from hassan254-prog May 5, 2026 17:19

hassan254-prog approved these changes May 5, 2026

View reviewed changes

adamjramirez and others added 2 commits May 5, 2026 13:30

Update packages/providers/providers.yaml

194c122

Co-authored-by: Hassan_Wari <85742599+hassan254-prog@users.noreply.github.com>

fix(jiminny): address remaining PR review comments

e86691a

- Remove broken docs link in jiminny.mdx (CI mintlify check was failing) - Update quickstart example endpoints /me → /v1/me (curl + Node SDK) - Remove default_value from region connection_config

hassan254-prog added this pull request to the merge queue May 5, 2026

Merged via the queue into NangoHQ:master with commit b17680d May 5, 2026
20 of 22 checks passed

	base_url: https://app.jiminny.${connectionConfig.region}/customer/api/v1
	base_url: https://app.jiminny.${connectionConfig.region}/customer/api

	description: Your Jiminny API key. Generate one in Jiminny under Org Settings → General → API Key (requires Admin or Owner role).
	description: Your Jiminny API key.

Conversation

adamjramirez commented Apr 25, 2026

Summary

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

adamjramirez commented Apr 27, 2026

Uh oh!

hassan254-prog left a comment

Choose a reason for hiding this comment

Uh oh!

hassan254-prog Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hassan254-prog Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

hassan254-prog Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

gitguardian Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

hassan254-prog left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hassan254-prog May 5, 2026

Choose a reason for hiding this comment

Uh oh!

hassan254-prog May 5, 2026

Choose a reason for hiding this comment

Uh oh!

hassan254-prog May 5, 2026

Choose a reason for hiding this comment

Uh oh!

adamjramirez May 5, 2026

Choose a reason for hiding this comment

Uh oh!

hassan254-prog commented May 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gitguardian Bot commented Apr 30, 2026 •

edited

Loading