# Pocket ID — OIDC Provider with Passkey Authentication

> A lightweight, self-hosted OpenID Connect Certified provider that lets users sign in to applications using passkeys instead of passwords.

## Install

Save in your project root:

# Pocket ID — OIDC Provider with Passkey Authentication

## Quick Use
```bash
docker run -d -p 443:443 
  -v pocket-id-data:/data 
  ghcr.io/pocket-id/pocket-id
```

## Introduction
Pocket ID is a self-hosted identity provider that implements the OpenID Connect standard with passkey-based authentication. Instead of managing passwords, users register and log in with biometrics or hardware security keys through the WebAuthn protocol. It is designed as a lightweight alternative to full identity platforms when all you need is SSO with modern passwordless auth.

## What Pocket ID Does
- Provides OpenID Connect Certified authentication for any application
- Enables passwordless login via passkeys (WebAuthn/FIDO2)
- Manages users, groups, and OIDC client registrations
- Issues standard JWT access and ID tokens
- Supports proxy authentication for reverse proxy setups

## Architecture Overview
Pocket ID is written in Go with a SvelteKit-based admin UI. It stores user credentials and client configurations in an embedded SQLite database. The OIDC flows are handled by a standards-compliant authorization server, while passkey operations use the WebAuthn protocol with resident credentials stored on the user's device or hardware key.

## Self-Hosting & Configuration
- Deploy via Docker with a single container and volume mount
- Configure OIDC clients through the web-based admin panel
- Set up TLS with built-in Let's Encrypt support or a reverse proxy
- Add users via the admin UI or LDAP sync
- Customize branding with logo and color settings

## Key Features
- OpenID Connect Certified for standards compliance
- Passkey-first authentication without password fallback
- Built-in admin UI for managing users and clients
- Lightweight single-binary deployment with SQLite
- Proxy auth endpoint for Nginx, Traefik, and Caddy integration

## Comparison with Similar Tools
- **Authentik** — Full-featured IdP with many protocols; Pocket ID is minimal and passkey-focused
- **Keycloak** — Enterprise-grade Java IdP; Pocket ID is a lightweight Go alternative
- **Authelia** — Focuses on 2FA and access control; Pocket ID is a full OIDC provider
- **TinyAuth** — Minimal auth proxy; Pocket ID provides complete OIDC flows with passkeys

## FAQ
**Q: Does it support traditional password login?**
A: Pocket ID is passkey-first by design. It does not support password-based authentication.

**Q: Can I use it with existing apps that support OIDC?**
A: Yes. Any application that supports OpenID Connect can use Pocket ID as its identity provider.

**Q: What databases does it support?**
A: It uses embedded SQLite by default, requiring no external database setup.

**Q: Is LDAP synchronization supported?**
A: Yes. You can sync users from an existing LDAP or Active Directory server.

## Sources
- https://github.com/pocket-id/pocket-id
- https://pocket-id.org

---
Source: https://tokrepo.com/en/workflows/asset-78fed4d4
Author: AI Open Source