PocketId
title: pocket-id type: platform created: 2026-05-26 last_updated: 2026-05-26 related: ["radar/platforms/Casdoor", "radar/platforms/Permify", "radar/techniques/WireGuardTunnel"] sources: ["https://github.com/stonith404/pocket-id"] radar_quadrant: Platforms radar_ring: Assess radar_position: inner
Minimal OIDC provider for self-hosted services where users authenticate exclusively with passkeys (WebAuthn/FIDO2) — no passwords, no email codes, no SMS. Issues standard OIDC tokens to downstream apps after a biometric tap.
pocket-id is a single-purpose identity provider. It implements the OIDC authorization code flow and handles user registration and authentication entirely via WebAuthn: Face ID, Touch ID, or hardware security keys (YubiKey, etc.). The server is a Go binary backed by SQLite, deployable as a Docker container.
Core capabilities:
- Passkey registration and authentication — browser-native WebAuthn; no client-side library required in connected apps
- OIDC token issuance — standard ID tokens and access tokens consumed by any OIDC-aware app (Authelia, Nginx auth_request, Cloudflare Access, etc.)
- Admin UI — manage users, clients, and audit logs via a web interface
- Single binary + SQLite — no external database; the entire stack fits in one Docker Compose service
pocket-id is the right choice when the goal is OIDC SSO for a small set of self-hosted apps and passkey authentication is the desired UX. It is intentionally narrow: no SAML, no LDAP sync, no fine-grained RBAC policies. For those requirements, casdoor (full IAM) or Keycloak (enterprise-grade) are more appropriate.
The natural position on the self-hosted auth stack:
- pocket-id — minimal OIDC IdP, passkey-only, zero complexity
- casdoor — full IAM platform: OAuth2, OIDC, SAML, LDAP, MFA, MCP gateway
- Permify — ReBAC authorization layer (works with any IdP)
pocket-id sits in the Assess ring of the Platforms quadrant, at inner position. First studied via GitHub (2024-08-13). The passkey-first authentication model eliminates the password management surface entirely — a meaningful security simplification for self-hosted contexts. Single Docker container deployment and SQLite storage lower the operational bar significantly compared to Keycloak or casdoor. Inner position reflects the clear trial path and direct applicability to any homelab running OIDC-aware services. Remaining gate before Trial is a deployment serving at least one real app with passkey authentication verified end-to-end.
