Pocket ID: Self-Hosted Passkey OIDC Provider

What Pocket ID is

Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 provider that signs users in with passkeys instead of passwords. It is OpenID Connect Certified, and it acts as the single place where users authenticate for every app you connect to it through OIDC, whether that app labels the option SSO, OAuth or OIDC. The documentation describes the target audience plainly: small teams, startups and homelabs that find Keycloak or Authentik too much for what they need. The README names Keycloak and ORY Hydra as the more complex alternatives it is reacting against.

The defining design choice is that Pocket ID only supports passwordless methods, primarily passkeys. There are no passwords to reuse, leak or phish. A passkey can live in a password manager, on a phone or on a hardware key such as a YubiKey, and it unlocks with a fingerprint, face scan or PIN. The maintainer is open about this being opinionated, noting in the README that some people may not like the idea at first. A public demo instance is available at demo.pocket-id.org.

How Pocket ID works

You register each application as an OIDC client with its own client ID, secret and callback URLs. When a user signs in, the app redirects them to Pocket ID, which checks their passkey and, if the client is restricted to certain groups, their group membership. The app then receives tokens containing the user's name, email address and groups, and creates its own session from them. Both the user's browser and the app need to reach Pocket ID, since the app fetches tokens directly.

The core concepts are small in number. Users sign in with passkeys, and an admin can issue a one-time login code, for example so a user can register a first passkey. Groups decide which users may sign in to which client and are passed to apps in the token so they can map roles. APIs represent your own back ends that accept Pocket ID access tokens, which the docs call a more advanced use case.

Under the hood, the repository's agent guide describes a Go back end (gin, GORM and a fork of ory/fosite) that serves a SvelteKit single-page app embedded into the binary for production. Pocket ID ships as one program with a built-in SQLite database, and the environment variable reference shows it can use PostgreSQL instead by pointing DB_CONNECTION_STRING at a postgres:// URL. Uploads such as logos and profile pictures can be stored on the filesystem, in the database or in S3-compatible storage.

Key features

• Passkey-only sign-in: admins can require user verification, allow or block synced passkeys, and restrict authenticators to device passkeys or external security keys.
• Sign in with another device: users without their passkey at hand, on a borrowed laptop or a TV, scan a QR code and approve the sign-in on their phone.
• Login codes: admin-issued one-time codes for onboarding and account recovery, plus an optional email login code that the docs flag as weakening security.
• Group-based access: restrict each OIDC client to specific groups and pass groups to apps for role mapping.
• LDAP sync: read users and groups from lldap, OpenLDAP or Active Directory on startup and every hour; synced entries are read-only in Pocket ID and users still sign in with passkeys.
• SCIM provisioning: push users and groups to apps that expose a SCIM endpoint, so accounts exist before first sign-in and are removed when access is revoked.
• OIDC back-channel logout: added in v2.17.0 according to the changelog.
• Client examples: the docs include step-by-step setup guides for nearly a hundred apps.
• Data export and import: the developer guide states a SQLite export must import into PostgreSQL and vice versa.

Getting started with Pocket ID

Passkeys only work on HTTPS pages (or localhost for testing), so plan for a domain such as id.example.com behind a reverse proxy. With Docker Compose, the installation guide downloads the Compose file and example environment file:

curl -O https://raw.githubusercontent.com/pocket-id/pocket-id/main/docker-compose.yml
curl -o .env https://raw.githubusercontent.com/pocket-id/pocket-id/main/.env.example

Set APP_URL to the address you will use and ENCRYPTION_KEY to a random string of at least 16 characters (the docs suggest generating one with openssl rand -base64 32), then start it:

docker compose up -d

Pocket ID listens on port 1411 and keeps its database and uploads in ./data. As a single binary, download the release for your platform, add the same .env file next to it, and run it:

curl -fL -o pocket-id https://github.com/pocket-id/pocket-id/releases/latest/download/pocket-id_linux_amd64
chmod +x pocket-id
./pocket-id

Then open /setup on your domain, create the admin account and add a passkey; the setup page only works until the first account exists. Building from source needs Go 1.27 or newer, Node.js 24 or newer with pnpm, and Git:

git clone https://github.com/pocket-id/pocket-id
cd pocket-id
git checkout "$(git describe --tags "$(git rev-list --tags --max-count=1)")"
pnpm install
pnpm --filter pocket-id-frontend build
cd backend
go build -o ../pocket-id ./cmd

Community-maintained options include a Podman Quadlet, a Proxmox helper script, Helm charts and a Kubernetes operator, an Unraid app, a NixOS module and brew install pocket-id.

Use cases

• Homelab single sign-on: one passkey, possibly on a YubiKey, for every self-hosted service that supports OIDC.
• Small-team SSO: give a startup's internal tools a shared login with group-based access, without running a heavier identity platform.
• Protecting apps without OIDC: put an authentication proxy in front of them; the docs cover Tinyauth, caddy-security for Caddy, OAuth2 Proxy and Traefik forward auth.
• Securing your own APIs: issue access tokens that your back ends accept, and the docs list a video on protecting an MCP server with OAuth 2.1 using Pocket ID.
• Bridging an existing directory: keep users in LDAP or Active Directory while moving sign-in to passkeys.

How Pocket ID compares

The project positions itself against Keycloak, Authentik and ORY Hydra, which it describes as often too complex for simple use cases. Pocket ID deliberately keeps its scope narrow: it provides OpenID Connect only, reads from LDAP but does not serve it, and leaves apps that need LDAP or SAML to an authentication proxy. If your users must be able to sign in with passwords, or your apps only speak SAML and you cannot put a proxy in front of them, Pocket ID will not cover those needs. If every app speaks OIDC and you want passkeys as the default, its single-binary, SQLite-by-default setup is the lighter option to run.

Things to know before adopting Pocket ID

• No passwords at all: users need a passkey or an admin-issued login code; plan the onboarding and recovery flow before rolling it out.
• HTTPS is mandatory: browsers only allow passkeys over HTTPS, so a reverse proxy with TLS is part of every real deployment.
• Email login trade-off: enabling email login codes means anyone who can read a user's mailbox can sign in as them.
• Outgoing requests: by default Pocket ID checks GitHub for new releases, sends an anonymous daily heartbeat (an instance UUID, version and timestamps, per the analytics page) and loads client icons from jsDelivr. VERSION_CHECK_DISABLED=true, ANALYTICS_DISABLED=true and ICON_LIBRARY_URL=disabled turn these off for air-gapped servers.
• SQLite on network shares: the docs warn against storing the SQLite database on NFS or SMB; use PostgreSQL or local storage instead.
• Licence: BSD-2-Clause, a permissive licence with no network-use obligations.
• Major versions: the docs include migration guides for v1 and v2, so read them before upgrading across major releases.

Project activity

As of October 2026 the pocket-id/pocket-id repository has about 9,500 stars. It was created on August 11, 2024, is written in Go with a SvelteKit front end, and is licensed under BSD-2-Clause. The latest release in the changelog at the time of writing is v2.18.0. Documentation and client examples are at pocket-id.org, and images are published as ghcr.io/pocket-id/pocket-id and pocketid/pocket-id on Docker Hub.