# Pocket ID — Lightweight OpenID Connect Provider with Passkey Auth

> Pocket ID is a self-hosted OpenID Connect provider that uses passkeys for authentication. It offers a simple, user-friendly identity provider that can replace heavier solutions for small to medium deployments.

## Install

Save in your project root:

# Pocket ID — Lightweight OpenID Connect Provider with Passkey Auth

## Quick Use

``````bash
# Run with Docker
docker run -d -p 80:80 
  -v pocket-id-data:/data 
  ghcr.io/pocket-id/pocket-id:latest

# Or use Docker Compose
git clone https://github.com/pocket-id/pocket-id.git
cd pocket-id
docker compose up -d

# Access the admin panel at http://localhost
# Complete the initial setup wizard to create your first admin account
``````

## Introduction

Pocket ID is a lightweight, self-hosted OpenID Connect (OIDC) certified identity provider built with Go. It uses passkeys (WebAuthn/FIDO2) as the primary authentication method, eliminating passwords entirely. It is designed for home labs and small teams that need SSO without the complexity of Keycloak or similar systems.

## What Pocket ID Does

- Provides an OpenID Connect certified identity provider for single sign-on
- Authenticates users via passkeys (WebAuthn/FIDO2) instead of passwords
- Manages OIDC clients with a clean web-based admin interface
- Supports user groups and claims for role-based access control in connected apps
- Stores all data in a single SQLite database file for easy backup

## Architecture Overview

Pocket ID is written in Go with a SvelteKit frontend. The backend implements the full OIDC specification including authorization code flow, token endpoints, and user info. Authentication is handled via the WebAuthn protocol, which delegates credential storage to the user's device or password manager. The application uses SQLite for persistence, keeping the deployment footprint minimal with no external database dependency.

## Self-Hosting & Configuration

- Deploy with Docker using the official ``ghcr.io/pocket-id/pocket-id`` image
- Configure the public URL and admin email via environment variables
- Set up OIDC clients through the admin panel with redirect URIs and allowed scopes
- Back up the single SQLite database file in the data volume for disaster recovery
- Place behind a reverse proxy with HTTPS, which is required for WebAuthn to function

## Key Features

- **Passkey authentication**: passwordless login via WebAuthn/FIDO2 on any modern device
- **OIDC certified**: fully compliant OpenID Connect provider for standards-based SSO
- **Simple deployment**: single binary with SQLite, no external database needed
- **Clean admin UI**: manage users, groups, and OIDC clients through a web interface
- **Lightweight**: low resource usage suitable for Raspberry Pi and small servers

## Comparison with Similar Tools

- **Keycloak**: full-featured enterprise IAM; Pocket ID is far simpler for small deployments
- **Authelia**: authentication portal with 2FA; Pocket ID focuses on passkeys and native OIDC
- **Authentik**: identity provider with flows engine; Pocket ID trades flexibility for simplicity
- **Dex**: OIDC federation layer; Pocket ID is a standalone provider with its own user store

## FAQ

**Q: Do passkeys work on all devices?**
A: Passkeys are supported on modern browsers and operating systems. Most devices from 2023 onward support them natively, and password managers like 1Password and Bitwarden can also store passkeys.

**Q: Can I use Pocket ID with Traefik or Nginx Proxy Manager?**
A: Yes. Place Pocket ID behind any reverse proxy that provides HTTPS. WebAuthn requires a secure context (HTTPS) to function.

**Q: Is there a way to add traditional password login?**
A: Pocket ID is designed around passkeys and does not support password-based login. This is an intentional security decision.

**Q: How do I back up Pocket ID?**
A: Copy the SQLite database file from the data directory. All users, clients, and configuration are stored in that single file.

## Sources

- Repository: https://github.com/pocket-id/pocket-id
- Documentation: https://pocket-id.org/docs

---
Source: https://tokrepo.com/en/workflows/asset-80685172
Author: AI Open Source