Penpot

Requirements

Self-hosted Penpot
HTTPS connection to your Penpot instance

Create the client in Pocket ID

In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
Enter a name such as Penpot and add the callback URL https://penpot.example.com/api/auth/oidc/callback.
Click Create and copy the Client ID and the Client secret. The client secret is only shown once.
On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Verify emails in Pocket ID

Open Administration → Users and select each user that should have access. If the icon next to the email isn’t green, click it to mark the email as verified, then save.

Configure Penpot

Penpot is configured with environment variables in its docker-compose.yml.

Add the enable-login-with-oidc flag to PENPOT_FLAGS, next to the flags already there:
```
x-flags: &penpot-flags
  PENPOT_FLAGS: <existing flags> enable-login-with-oidc
```

Add the OIDC variables to the penpot-backend service, with the values from Pocket ID:

PENPOT_OIDC_BASE_URI: https://id.example.com
PENPOT_OIDC_CLIENT_ID: <client-id>
PENPOT_OIDC_CLIENT_SECRET: <client-secret>

Optional: If the Pocket ID hostname resolves to a private, loopback or otherwise internal address, allow it through Penpot’s SSRF protection:
```
PENPOT_SSRF_ALLOWED_HOSTS: "id.example.com"
```
Optional: If the browser reaches Pocket ID at a public address but the backend has to use an internal one, which is common when running Docker on a Synology NAS, pin the hostname on the penpot-backend service:
```
extra_hosts:
  - "id.example.com:<internal-ip-address>"
```

Automatic user creation

Penpot doesn’t create new profiles from OIDC sign-ins by default. To let new users sign up with their Pocket ID account, add the enable-oidc-registration flag to PENPOT_FLAGS.

To harden security, disable password login by adding the disable-login-with-password flag to PENPOT_FLAGS. Keep a working recovery path, such as admin access to Pocket ID and the Penpot database, before you do.

Troubleshooting

Error in the address bar after returning from Pocket ID	Cause	Fix
`error=unable-to-auth&hint=uri+target+is+not+allowed`	Penpot’s SSRF protection blocked the backend’s request to Pocket ID, because the hostname resolves to a private or loopback address	Add the Pocket ID hostname to `PENPOT_SSRF_ALLOWED_HOSTS` and restart `penpot-backend`
`error=auth-provider-not-allowed`	The email belongs to an existing profile, for example one created with a password, but isn’t verified in Pocket ID	Mark the user’s email as verified in Pocket ID
`error=registration-disabled`	No Penpot profile exists for the email and registration is disabled	Add the `enable-oidc-registration` flag to `PENPOT_FLAGS`

Sources

Penpot configuration guide