Pocket ID — Lightweight OpenID Connect Provider with Passkey Auth

Introduction

Pocket ID is a lightweight, self-hosted OpenID Connect (OIDC) certified identity provider built with Go. It uses passkeys (WebAuthn/FIDO2) as the primary authentication method, eliminating passwords entirely. It is designed for home labs and small teams that need SSO without the complexity of Keycloak or similar systems.

What Pocket ID Does

• Provides an OpenID Connect certified identity provider for single sign-on
• Authenticates users via passkeys (WebAuthn/FIDO2) instead of passwords
• Manages OIDC clients with a clean web-based admin interface
• Supports user groups and claims for role-based access control in connected apps
• Stores all data in a single SQLite database file for easy backup

Architecture Overview

Pocket ID is written in Go with a SvelteKit frontend. The backend implements the full OIDC specification including authorization code flow, token endpoints, and user info. Authentication is handled via the WebAuthn protocol, which delegates credential storage to the user's device or password manager. The application uses SQLite for persistence, keeping the deployment footprint minimal with no external database dependency.

Self-Hosting & Configuration

• Deploy with Docker using the official ghcr.io/pocket-id/pocket-id image
• Configure the public URL and admin email via environment variables
• Set up OIDC clients through the admin panel with redirect URIs and allowed scopes
• Back up the single SQLite database file in the data volume for disaster recovery
• Place behind a reverse proxy with HTTPS, which is required for WebAuthn to function

Key Features

• Passkey authentication: passwordless login via WebAuthn/FIDO2 on any modern device
• OIDC certified: fully compliant OpenID Connect provider for standards-based SSO
• Simple deployment: single binary with SQLite, no external database needed
• Clean admin UI: manage users, groups, and OIDC clients through a web interface
• Lightweight: low resource usage suitable for Raspberry Pi and small servers

Comparison with Similar Tools

• Keycloak: full-featured enterprise IAM; Pocket ID is far simpler for small deployments
• Authelia: authentication portal with 2FA; Pocket ID focuses on passkeys and native OIDC
• Authentik: identity provider with flows engine; Pocket ID trades flexibility for simplicity
• Dex: OIDC federation layer; Pocket ID is a standalone provider with its own user store

FAQ

Q: Do passkeys work on all devices? A: Passkeys are supported on modern browsers and operating systems. Most devices from 2023 onward support them natively, and password managers like 1Password and Bitwarden can also store passkeys.

Q: Can I use Pocket ID with Traefik or Nginx Proxy Manager? A: Yes. Place Pocket ID behind any reverse proxy that provides HTTPS. WebAuthn requires a secure context (HTTPS) to function.

Q: Is there a way to add traditional password login? A: Pocket ID is designed around passkeys and does not support password-based login. This is an intentional security decision.

Q: How do I back up Pocket ID? A: Copy the SQLite database file from the data directory. All users, clients, and configuration are stored in that single file.

Sources

• Repository: https://github.com/pocket-id/pocket-id
• Documentation: https://pocket-id.org/docs