Your first API call in 5 minutes

The fastest way in is a personal access token — no OAuth, no app registration. It reads and writes your own pon data, which is exactly right for scripts, Home Assistant and homelab things.

1. Get pon on your iPhone

   Your account and lists live in the app — grab pon from the App Store and sign up there.

   

2. Sign in at my.pon.app

   Use your pon account. Your e-mail must be confirmed — enrollment answers 403 EMAIL_UNVERIFIED otherwise.

3. Enable developer mode

   my → For developers. You accept the API terms once.

4. Create a token

   Pick the scopes you need. The secret pon_pat_… is shown once — store it like a password. Expiry: 90 days by default, up to 365, or never.

5. Call the API

   That’s it — plain Bearer, no signing dance:

# list your lists
curl https://api.pon.app/v3/lists \
  -H "Authorization: Bearer pon_pat_XXXX"

const res = await fetch("https://api.pon.app/v3/lists", {
  headers: { Authorization: "Bearer pon_pat_XXXX" },
});
const { data } = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://api.pon.app/v3/lists",
    headers={"Authorization": "Bearer pon_pat_XXXX"},
)
print(res.json()["data"])

Add an item

POST /v3/lists/{list-id}/items — the write side works the same way:

curl -X POST https://api.pon.app/v3/lists/LIST_ID/items \
  -H "Authorization: Bearer pon_pat_XXXX" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Oat milk" }'

await fetch(`https://api.pon.app/v3/lists/${listId}/items`, {
  method: "POST",
  headers: {
    Authorization: "Bearer pon_pat_XXXX",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "Oat milk" }),
});

requests.post(
    f"https://api.pon.app/v3/lists/{list_id}/items",
    headers={"Authorization": "Bearer pon_pat_XXXX"},
    json={"name": "Oat milk"},
)

Every response uses the same envelope: { "data": …, "meta": … } on success, { "errors": [ { "code", "message" } ] } on failure.

Next steps

• Authentication — when a token is enough, and when you want OAuth.
• Webhooks — react to list changes without polling.
• Limits & fair use — what’s generous, and what’s a cap.