Skip to content
Pocket ID
v2.19.1GitHub

Introduction

A self-hosted OpenID Connect Certified™ and OAuth 2.0 provider that lets your users sign in to every app you host with a passkey instead of a password.

Pocket ID is the one place where your users sign in, for every app you connect to it through OpenID Connect (OIDC). It’s made for small teams, startups and homelabs that find Keycloak or Authentik too much for what they need.

Pocket ID only supports passwordless authentication methods, primarily passkeys, so there are no passwords to reuse, leak or phish. A passkey can live in a password manager, on a phone or on a hardware key such as a YubiKey, and it unlocks with a fingerprint, face scan or PIN.

The Pocket ID sign-in page with an Authenticate buttonThe Pocket ID sign-in page with an Authenticate button

You can try it on the demo instance.

How sign-in works

Section titled “How sign-in works”

Any app that offers sign-in with OpenID Connect, often labeled as SSO, OAuth or OIDC, can use Pocket ID. You register the app in Pocket ID as an OIDC client, and the app sends its users to Pocket ID when they sign in.

If you are interested in the technical details, the diagram below shows the typical sign-in flow with Pocket ID. No worries though, you don’t have to understand how OIDC and OAuth 2.0 work to use it.

Server to serverBrowserthe userYour appthe OIDC clientPocket IDthe OIDC provideropens the appredirect to Pocket IDsign in with a passkeychecks the passkey and allowed groupsredirect to the callback URL with a codecallback URL ?code=…code, client ID and secretID token and access tokensigned in
The browser carries the user between the app and Pocket ID, while the app fetches the tokens from Pocket ID directly, so both the browser and the app need to reach Pocket ID.

Pocket ID only lets a user through when their passkey checks out and, if you restricted the client to some groups, when they’re a member of one of them. The app then receives tokens with the user’s name, email address and groups, and creates its own session from them.

Apps without OIDC support, and apps that only support LDAP or SAML, can still sit behind Pocket ID with an authentication proxy, as Proxy services shows.

Concepts

Section titled “Concepts”
  • Users sign in with their passkeys, and an admin can let a user in once with a login code, such as to add their first passkey.
  • Groups decide which users may sign in to which client, and the apps you connect receive them in the token to assign roles.
  • OIDC clients are the apps that use Pocket ID for sign-in, each with its own client ID, secret and callback URLs.
  • APIs are your own backends that accept access tokens from Pocket ID, which you only need for API access. This is a more advanced use case.

Next steps

Section titled “Next steps”
Install Pocket IDStart Pocket ID with Docker Compose or as a single binary.
Put it behind HTTPSPasskeys only work over HTTPS, so Pocket ID needs a reverse proxy.
Connect your first appCreate an OIDC client and give the app the values it asks for.
Client examplesStep-by-step setup for nearly a hundred apps, from Immich to Proxmox.

Videos

Section titled “Videos”