Pocket ID — OIDC Provider with Passkey Authentication

Introduction

Pocket ID is a self-hosted identity provider that implements the OpenID Connect standard with passkey-based authentication. Instead of managing passwords, users register and log in with biometrics or hardware security keys through the WebAuthn protocol. It is designed as a lightweight alternative to full identity platforms when all you need is SSO with modern passwordless auth.

What Pocket ID Does

• Provides OpenID Connect Certified authentication for any application
• Enables passwordless login via passkeys (WebAuthn/FIDO2)
• Manages users, groups, and OIDC client registrations
• Issues standard JWT access and ID tokens
• Supports proxy authentication for reverse proxy setups

Architecture Overview

Pocket ID is written in Go with a SvelteKit-based admin UI. It stores user credentials and client configurations in an embedded SQLite database. The OIDC flows are handled by a standards-compliant authorization server, while passkey operations use the WebAuthn protocol with resident credentials stored on the user's device or hardware key.

Self-Hosting & Configuration

• Deploy via Docker with a single container and volume mount
• Configure OIDC clients through the web-based admin panel
• Set up TLS with built-in Let's Encrypt support or a reverse proxy
• Add users via the admin UI or LDAP sync
• Customize branding with logo and color settings

Key Features

• OpenID Connect Certified for standards compliance
• Passkey-first authentication without password fallback
• Built-in admin UI for managing users and clients
• Lightweight single-binary deployment with SQLite
• Proxy auth endpoint for Nginx, Traefik, and Caddy integration

Comparison with Similar Tools

• Authentik — Full-featured IdP with many protocols; Pocket ID is minimal and passkey-focused
• Keycloak — Enterprise-grade Java IdP; Pocket ID is a lightweight Go alternative
• Authelia — Focuses on 2FA and access control; Pocket ID is a full OIDC provider
• TinyAuth — Minimal auth proxy; Pocket ID provides complete OIDC flows with passkeys

FAQ

Q: Does it support traditional password login? A: Pocket ID is passkey-first by design. It does not support password-based authentication.

Q: Can I use it with existing apps that support OIDC? A: Yes. Any application that supports OpenID Connect can use Pocket ID as its identity provider.

Q: What databases does it support? A: It uses embedded SQLite by default, requiring no external database setup.

Q: Is LDAP synchronization supported? A: Yes. You can sync users from an existing LDAP or Active Directory server.

Sources

• https://github.com/pocket-id/pocket-id
• https://pocket-id.org