Towerflow API

Automate trading strategies powered by signals and AI.

Towerflow allows you to create LLM-powered strategies, trigger them with cron schedules, and automatically execute trades or signals.

This API uses HMAC authentication. Every request must be signed using your API secret.

Production

Base URL

https://api.towerflow.io/api/v2

---

Getting Started

1

Create an account

Create a Towerflow account in the dashboard.

2

Generate an API key

Navigate to API Management and create a new key.

3

Sign your request

All requests must include the following headers:

Header	Description
api-key	Your public API key
timestamp	Current unix timestamp
signature	HMAC SHA256 signature

4

Make your first request

GET strategy/llm-session

---

Signature generation examples

Signatures are generated using HMAC SHA256 and your API secret.

GET / DELETE requests use:

METHOD + PATH + TIMESTAMP

POST / PUT requests use:

METHOD + PATH + BODY + TIMESTAMP

TypeScript example (GET request)

import crypto from "crypto"

const API_KEY = "your_public_api_key"
const API_SECRET = "your_private_api_secret"

const method = "GET"
const path = "/api/v2/strategy/llm-session"
const timestamp = Math.floor(Date.now() / 1000).toString()

const message = method + path + timestamp

const signature = crypto
  .createHmac("sha256", API_SECRET)
  .update(message)
  .digest("hex")

TypeScript example (POST request)

import crypto from "crypto"

const API_KEY = "your_public_api_key"
const API_SECRET = "your_private_api_secret"

const method = "POST"
const path = "/api/v2/strategy/llm-session"

const body = {
  name: "My Strategy",
  cron_interval: "15m"
}

const timestamp = Math.floor(Date.now() / 1000).toString()

const payload =
   method + path + JSON.stringify(body) + timestamp

const signature = crypto
  .createHmac("sha256", API_SECRET)
  .update(payload)
  .digest("hex")
  

---

Example request

curl https://api.towerflow.io/api/v2/strategy/sessions \
  -H "api-key: YOUR_API_KEY" \
  -H "timestamp: 1700000000" \
  -H "signature: GENERATED_SIGNATURE"

Never expose your API secret in frontend code. Always generate HMAC signatures on your backend.