GlowFi

Read your portfolio from a spreadsheet or a script

GlowFi gives you three ways to use your own data elsewhere: a private link for a spreadsheet, a personal token to read it from a script, and webhooks that call your address when something happens. All three are read-only and need a plan with API access.

Spreadsheet link

In the app, open the account menu, then API and webhooks, and create a spreadsheet link. You get one secret address per file. Anyone who has an address can read that data, so keep it private; you can revoke it at any time.

Google Sheets

=IMPORTDATA("https://YOUR-SITE/sheet/gs_…/positions.csv")

Google refreshes IMPORTDATA by itself about every hour. If your spreadsheet uses French settings and the decimals look wrong, add ?fr=1 at the end of the address.

Excel

Data, then Get Data, then From Web, and paste the address. Or download the Excel query file (.iqy) offered when you create the link and open it in Excel. Use Refresh All, or set a refresh every few minutes in the query properties.

Limits: 60 requests a minute per link. Prices come from Yahoo Finance and can be delayed. Amounts are in each asset’s own currency.

Personal token and API

Create a token in the same place. Send it in the Authorization header. A token only reads: it cannot change your account or manage other tokens.

curl -H "Authorization: Bearer gf_YOUR_TOKEN" https://YOUR-SITE/api/v1/positions

Example in JavaScript

const r = await fetch('https://YOUR-SITE/api/v1/positions', {
  headers: { Authorization: 'Bearer ' + process.env.GLOWFI_TOKEN },
});
const { positions } = await r.json();
console.table(positions.map((p) => ({ symbol: p.symbol, value: p.value, gain: p.gain })));

Please ask no more than once a minute: prices are refreshed about every ten seconds on our side, and heavy use can be limited. Up to 5 tokens per account.

Webhooks

GlowFi sends a signed POST request to an https address you choose when a price alert triggers (alert.triggered) or a transaction is added (transaction.created). After 10 failures in a row, the webhook is turned off until you turn it back on.

POST https://your-address.example/hook
Content-Type: application/json
X-GlowFi-Event: alert.triggered
X-GlowFi-Delivery: 7c0f…
X-GlowFi-Timestamp: 1767225600
X-GlowFi-Signature: sha256=9b2e…

{ "id": "7c0f…", "event": "alert.triggered", "createdAt": "2026-01-01T00:00:00.000Z", "data": { … } }

Check the signature

The signature is sha256= followed by the HMAC-SHA256 of the timestamp, a dot and the raw body, using your webhook secret. Reject messages whose timestamp is more than five minutes old.

const crypto = require('crypto');
function valid(secret, headers, rawBody) {
  const ts = headers['x-glowfi-timestamp'];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(ts + '.' + rawBody).digest('hex');
  const got = headers['x-glowfi-signature'] || '';
  return got.length === expected.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
}