How API Keys Work in Pony Express HQ
Create, use, and revoke API keys to connect Pony Express HQ to Zapier and your own integrations.
An API key lets another application act on behalf of your Pony Express HQ organization. Zapier uses one to connect, and you can use the same key for your own scripts and integrations.
Creating a key
Go to Settings > API Keys in your dashboard and choose Create API Key. Give it a name that says where it will be used, for example “Zapier” or “Website form”, so you can tell your keys apart later.
The full key is shown only once, at the moment you create it. Copy it straight away and store it somewhere safe, such as a password manager. If you lose it you cannot recover it — you simply create a new key and revoke the old one.
What a key looks like
Every key begins with pony_sk_ followed by a short public prefix and a long secret. The dashboard only ever shows you the prefix after creation, which is how you match a key in the list to the one your integration is using.
Connecting Zapier
When Zapier asks you to sign in to Pony Express HQ, paste your key into the API Key field. Zapier confirms the connection and labels it with the email address on the account. One key is enough for all of your Zaps — you do not need a separate key per Zap.
What a key can do
A key acts on the organization it was created in, and it can do the things that account can do: add and update contacts, manage groups, send messages and broadcasts, and record opt-outs. Treat it like a password. Anyone holding it can message your contacts, so never put a key in client-side code, a public repository, or a screenshot.
Revoking and rotating
You can revoke a key at any time from the same Settings > API Keys screen. Revoking takes effect immediately and anything still using that key stops working, so create the replacement and update your integration first, then revoke the old one. It is good practice to rotate keys periodically, and straight away if you think one has been exposed.
Need a hand?
If a key is not working, check that you copied the whole value including the pony_sk_ prefix, and that it has not been revoked.
Still stuck? Email support@ponyexpresshq.com and we will help.