Everything the add-on does, in plain terms.
Four things happen in an import: you point at data, you decide its shape, you write it somewhere, and you keep it fresh. This page covers each, plus what is deliberately not built yet.
Point at the data
Six ways in. Four of them never touch our servers.
Paste or read from a cell
Drop a payload into the sidebar or point at a cell that already holds one. Parsed locally, no account needed.
Public URL
A fresh read-only GET with no upstream credentials, started from the sidebar under the active user's account.
Full request builder
GET, POST, PUT, PATCH, DELETE with query parameters, custom headers, and JSON or form bodies.
Read JSON from a cell
Load JSON already stored in the selected spreadsheet cell, then inspect and reshape it locally without a network request.
Request variables bound to cells
Named placeholders resolved at run time from the cells you choose, in the URL, query, path, headers, or body.
Range to JSON
Select a table with headers and get an array of objects, an object, or row arrays back. Local and unmetered.
Decide the shape
The part other importers guess at. You see the table before it is written.
Visual explorer
A searchable field list with type badges and array counts. Tick fields, pick a root array, and paths are generated for you after the payload has been fetched and parsed.
Exact output preview
The real headers, representative cell values, and predicted row and column counts — with a warning when a mode will multiply parent records.
Three query languages
Simple dot paths for beginners, a documented JSONPath subset, and JMESPath for filtering and reshaping. The sidebar always labels which one is active.
Deterministic flattening
Nested keys become dot-notation columns in a stable order. Source keys that already contain dots or brackets are escaped rather than silently merged.
Three nested-array modes
rows repeats the parent, join collapses to one cell, json keeps the array intact.
Types that survive the trip
Booleans stay booleans, nulls become blank cells by default, integers beyond the safe numeric range stay text, and numeric or date-looking strings remain text.
Write it safely
An import should never be the reason you reach for version history.
Managed output ranges
Each import remembers the range it owns and refreshes only that. Touching data outside it needs your confirmation, and no run clears a whole worksheet.
Overwrite, append, upsert
Update-or-append matches on one unique key, updates managed columns, appends new keys, and never deletes rows that are missing from the latest response.
Honest row accounting
Writes report inserted, updated, and unchanged counts. Upsert stops before writing when a source key is blank or duplicated and explains which validation failed.
Formula-injection protection
Remote text starting with =, +, -, or @ is escaped by default so a payload cannot execute in your sheet.
Destination choice
The selected cell, the active sheet, or a fresh sheet. Written in batches, not cell by cell.
Limits before damage
Row and column caps are enforced before anything is written, so an unexpectedly huge response fails cleanly.
Keep it running
Bounded caching, clear previews, and enough visibility to understand the result before writing it.
Saved requests
Name, rerun, schedule, or delete saved imports while preserving the request, transformation, write mode, and destination.
Scheduled refresh
Authorized hourly, daily, or weekly refresh with an entitlement check and fresh spreadsheet-variable values on every run.
Fresh URL previews
Every manual preview fetches the source again, so changing JSON endpoints do not silently serve stale data.
Fresh request metadata
Previews report rows, columns, and pagination details without retaining response bodies in a cache. Current fetch usage is shown in the add-on’s Account tab.
Errors that say what to do
No bare #ERROR! and no stack traces.
Usage in view
The Account tab shows current usage, the allowance, and the exact reset timestamp. Remote fetches stop at the limit. See the plans →
Credentials
Your API tokens are the most dangerous thing in a spreadsheet. They do not live in one.
Encrypted authenticated connections
Save bearer tokens, API keys, basic auth, and custom secret headers outside spreadsheet cells.
Encrypted at rest
Saved credentials are encrypted and authenticated at rest in Supabase Vault. Saved request metadata stores only an opaque Vault reference, not the raw credential.
Write-only
A secret is never returned after saving. Delete and recreate a connection whenever you need to rotate or revoke its credential.
Never in a formula
Formula arguments cannot carry secrets, so a shared spreadsheet cannot leak yours.
URL safety checks
Every fetch resolves DNS first and refuses private, loopback, link-local, and cloud-metadata addresses. Saved credentials stay on the configured origin and are stripped before a cross-origin redirect.
Purpose-limited Google scopes
Interactive work is limited to the open spreadsheet. Scheduled refresh uses explicit per-file access granted through Google Picker. No Drive search, Gmail, contacts, calendars, or non-Sheets Drive content. Details →
Not built yet — on purpose
If it is on this list, it does not work today. We would rather ship a smaller product that does what it says. Follow the changelog →
See the formula surface next.
Thirteen functions, twelve of them local and unmetered.