Authentication

Two ways in, one rule: who owns the data decides the mechanism.

Personal access tokens

A PAT acts as you — it can only ever reach your own lists, items and profile. Plain Authorization: Bearer pon_pat_…, nothing else. Use it for scripts, cron jobs, Home Assistant, dashboards.

• Created at my.pon.app → Access tokens, scoped per token.
• Expiry: 90 days by default, up to 365, or never-expiring if you choose.
• Up to 10 tokens per account; the secret is shown exactly once.
• PATs cover the lists, products and profile scopes — the media scopes are reserved for OAuth apps.

Apps that sign in other people

Everything above covers your own account. The moment an app signs in other pon users, it runs on OAuth 2.1 via the hosted login at auth.pon.app — and those partner clients are set up individually by us. Building something like that? Write to [email protected] and we’ll get you started.

Scopes

Request the smallest set that works — you can always create another token with more.

Errors you’ll meet

• 401 UNAUTHORIZED — missing/expired token, or a DPoP proof problem (the WWW-Authenticate header tells you which).
• 403 DEVELOPER_MODE_REQUIRED — the account never enabled developer mode.
• 403 EMAIL_UNVERIFIED — confirm the account’s e-mail address first.