We have experimentally demonstrated a decoy-state quantum key distribution scheme (QKD) with a heralded single-photon source based on parametric down-conversion. We used a one-way Bennett-Brassard 1984 protocol with a four states and one-detector phase-coding scheme, which is immune to recently proposed time-shift attacks, photon-number splitting attacks, and can also be proven to be secure against Trojan horse attacks and any other standard individual or coherent attacks. In principle, the setup can tolerate the highest losses or it can give the highest secure key generation rate under fixed losses compared with other practical schemes. This makes it a quite promising candidate for future quantum key distribution systems.