Logo
Deploy Now

SaaS Alternative

Auth0 Okta

Categories

Self-Hosted Security Authentication Identity Provider Passkeys OIDC Single Sign-On

Stars

8,954

Forks

301

Watchers

21

Developer links

Last Updated: 08-21-2026 08:23 AM (UTC)

Pocket ID

Backed by over 8,700 GitHub stars and OpenID Connect certification, Pocket ID delivers what enterprise identity platforms like Keycloak provide but without the configuration complexity — a passkey-only OIDC provider purpose-built for homelabs and small deployments. The core design decision is radical simplicity: no passwords exist in the system, only WebAuthn-based passkeys using hardware security keys, TouchID, FaceID, or device PINs, making phishing attacks structurally impossible rather than merely discouraged. The Go backend built on the Gin framework serves a compiled SvelteKit frontend as static assets, running as a single Docker container with SQLite as the default database and optional PostgreSQL for larger deployments. User management supports manual creation, signup links, and open registration, with group-based access control that restricts which OIDC clients each group can access and attaches custom claims for downstream role mapping. LDAP synchronization pulls users and groups from OpenLDAP or Active Directory, while SCIM support enables automated provisioning from compatible identity sources. Federated client credentials handle machine-to-machine authentication for service-to-service communication patterns. The audit system logs every authentication event with GeoIP enrichment, sends email notifications for sign-ins from unknown devices, and provides one-time login codes for accessing accounts from devices without passkey support. TLS with HTTP/2 is built in, PKCE adds code exchange protection, and OpenTelemetry provides tracing and metrics integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD 2-Clause licensed.

Pocket ID
Pocket ID
Pocket ID
Pocket ID
Pocket ID

Benefits

  • Passwordless Security By Design
  • WebAuthn passkey-only authentication eliminates passwords entirely, making phishing attacks structurally impossible while supporting hardware keys, TouchID, FaceID, and device PINs.
  • Simple Single Sign-On Setup
  • Connect any OIDC-compatible application in minutes with a clean admin interface for managing clients, callback URLs, and PKCE settings without enterprise complexity.
  • Lightweight Self-Hosted Deployment
  • Runs as a single Docker container with embedded SQLite, requiring minimal resources suitable for Raspberry Pi deployments, with optional PostgreSQL for scaling.
  • Directory Integration Built In
  • Synchronize users and groups from OpenLDAP or Active Directory via LDAP, with SCIM support for automated provisioning from compatible identity management sources.

Features

  • OIDC Certified Provider
  • OpenID Connect Certified with full OAuth 2.0 support, PKCE code exchange protection, custom claims, and federated client credentials for machine-to-machine auth.
  • Group Access Control
  • Restrict OIDC clients to specific user groups with custom claim attachment for downstream role mapping and per-service authorization policies.
  • Comprehensive Audit Logging
  • Log every authentication event with GeoIP enrichment using MaxMind, email alerts for unknown devices, and one-time login codes for passkey-less access.
  • LDAP and SCIM Sync
  • Pull users and groups from OpenLDAP or Active Directory directories with scheduled LDAP synchronization and SCIM-based automated provisioning support.
  • Built-in TLS and HTTP/2
  • Native TLS termination with HTTP/2 support, eliminating the need for reverse proxy SSL configuration in simple deployment scenarios.