Backed by over 8,700 GitHub stars and OpenID Connect certification, Pocket ID delivers what enterprise identity platforms like Keycloak provide but without the configuration complexity — a passkey-only OIDC provider purpose-built for homelabs and small deployments. The core design decision is radical simplicity: no passwords exist in the system, only WebAuthn-based passkeys using hardware security keys, TouchID, FaceID, or device PINs, making phishing attacks structurally impossible rather than merely discouraged. The Go backend built on the Gin framework serves a compiled SvelteKit frontend as static assets, running as a single Docker container with SQLite as the default database and optional PostgreSQL for larger deployments. User management supports manual creation, signup links, and open registration, with group-based access control that restricts which OIDC clients each group can access and attaches custom claims for downstream role mapping. LDAP synchronization pulls users and groups from OpenLDAP or Active Directory, while SCIM support enables automated provisioning from compatible identity sources. Federated client credentials handle machine-to-machine authentication for service-to-service communication patterns. The audit system logs every authentication event with GeoIP enrichment, sends email notifications for sign-ins from unknown devices, and provides one-time login codes for accessing accounts from devices without passkey support. TLS with HTTP/2 is built in, PKCE adds code exchange protection, and OpenTelemetry provides tracing and metrics integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD 2-Clause licensed.

Powering authentication for over 15,000 GitHub stargazers and production deployments across startups and enterprises alike, SuperTokens delivers the complete login infrastructure that Auth0, Firebase Auth, and AWS Cognito charge premium prices for — entirely open source under Apache 2.0 with no per-user limits. The Java-based core service runs as a lightweight HTTP microservice that connects to PostgreSQL or MySQL and handles email-password login, passwordless magic links and OTP via email or SMS, social OAuth with Google, GitHub, Facebook, Apple, and any custom OIDC provider, phone-password authentication, and time-based one-time password multi-factor authentication. Session management uses rotating refresh tokens with anti-CSRF and anti-session-fixation protections, verifying tokens locally in your backend SDK without network round-trips to the core. Frontend SDKs for React, React Native, Angular, Vue, and vanilla JavaScript provide pre-built UI components for login, signup, email verification, and password reset flows, all customizable through an override system that lets you add pre- and post-API logic, custom hooks, and user event handlers. The built-in user management dashboard enables administrators to view users, reset passwords, revoke sessions, modify roles, and manage email verification status. Multi-tenancy and organization support powers B2B SaaS applications with tenant-level authentication configuration and Enterprise SSO via SAML and OIDC. Migration tools support bulk importing millions of existing password hashes, TOTP secrets, and role mappings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.