[{"data":1,"prerenderedAt":209},["ShallowReactive",2],{"seo-verification":3,"blog-pocket-id-lightweight-oidc-provider-in-one-container-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-pocket-id-lightweight-oidc-provider-in-one-container-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":153,"ctaBody":154,"ctaButton":155,"ctaUrl":156,"relatedPosts":157},443,"pocket-id-lightweight-oidc-provider-in-one-container",{"fr":12,"en":10,"ar":13,"es":14},"pocket-id-oidc-self-hosted-vps","pocket-id-على-vps-مزود-oidc-خفيف-بحاوية-واحدة","pocket-id-proveedor-oidc-ligero-en-un-solo-contenedor","Pocket ID: lightweight OIDC provider in one container","Pocket ID v2.18.0 is a self-hosted OpenID Connect provider in a single Docker container, no external database, passkeys only, under 50 MB RAM at idle.",9,0,false,"2026-10-15T00:00:00+00:00","2026-10-16T01:57:35+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fpocket-id-oidc-self-hosted-vps-poster.svg","Running a full Keycloak or Authentik instance for three or four self-hosted services means deploying a JVM or a multi-container orchestration to solve a problem that fits in a single Go binary. Pocket ID v2.18.0 (October 4, 2026) is a certified OpenID Connect provider that runs in a single container, stores its data in SQLite, and consumes less than 50 MB of RAM at idle — where Keycloak needs hundreds of megabytes. It does OIDC only, it accepts passkeys only, and that is precisely what makes it deployable in five minutes on any VPS.",[35,39,51,54,82,85,89,92,100,150],{"type":36,"title":37,"body":38},"h2","Why self-host your OIDC provider","Every self-hosted service that manages its own user base introduces a dependency you have to maintain: passwords to reset, accounts to revoke, sessions to invalidate. Multiplied across five or ten services, that becomes a real operational burden. An identity provider (IdP) centralises this work: a single source of identity, revocation that applies everywhere, a single MFA configuration point.\n\nThe question is not whether you need an IdP, but which one — and on what foundation you are willing to operate it.",{"type":40,"title":41,"items":42},"ul","What you get with a self-hosted OIDC IdP",[43,44,45,46,47,48,49,50],"**Centralised identity** — a single account for Gitea, Nextcloud, Grafana and all OIDC-compatible services.","**Global revocation** — disabling an account in Pocket ID cuts access to all connected applications at the next token renewal.","**Passkey authentication** — Touch ID, Face ID or a FIDO2 key as the sole factor, with no password to transmit.","**No cloud dependency** — your identities stay under your jurisdiction, with no per-user quota or per-action pricing.","**Minimal footprint** — Pocket ID consumes less than 50 MB of RAM at idle, versus 300–600 MB for Authentik and 1–2 GB for Keycloak.","**Embedded SQLite** — no external database engine to provision or back up separately.","**Back-channel logout (v2.18.0)** — when a user is disabled or revokes a client, Pocket ID notifies registered applications and invalidates their server-side sessions.","**Single container** — the entire service fits in a ~30 MB Docker image, with no Redis dependency and no separate worker.",{"type":36,"title":52,"body":53},"Concrete prerequisites","Pocket ID is designed for small stacks. Its requirements are intentionally low:\n\n- **Docker 24+** and Docker Compose v2 — required by the official image.\n- **512 MB RAM minimum** on the VPS — Pocket ID runs under 50 MB at idle; the rest serves the OS and the reverse proxy.\n- **A domain and a TLS certificate** — OIDC requires HTTPS without exception; without a publicly reachable domain (or an internal network with TLS), the installation cannot function.\n- **No external database** — SQLite is embedded. If you prefer PostgreSQL for simpler backups, switching is done by changing a single environment variable.\n\nPocket ID does not handle SAML, LDAP, or directory federation. If your stack includes applications that only accept SAML, or if you need to federate an Active Directory, use Authentik or Keycloak instead. For a stack of modern web services that support OIDC, Pocket ID covers the need without the overhead.",{"type":55,"title":56,"steps":57},"steps","Installing Pocket ID",[58,61,64,67,70,73,76,79],{"title":59,"body":60},"Prepare the VPS and domain","Order a VPS running Ubuntu 22.04 or Debian 12 with at least 512 MB of RAM. Create a DNS A record pointing `auth.your-domain.com` to your VPS IP address. This subdomain is the public URL of your Pocket ID instance — it must be reachable before the first configuration, as OIDC redirects depend on it.\n\nInstall Docker and the Compose plugin:\n```bash\ncurl -fsSL https:\u002F\u002Fget.docker.com | sh\n```",{"title":62,"body":63},"Create the working directory","On the server, create a dedicated directory:\n```bash\nmkdir -p \u002Fopt\u002Fpocket-id && cd \u002Fopt\u002Fpocket-id\n```",{"title":65,"body":66},"Write the docker-compose.yml file","Create `\u002Fopt\u002Fpocket-id\u002Fdocker-compose.yml`:\n```yaml\nservices:\n  pocket-id:\n    image: ghcr.io\u002Fpocket-id\u002Fpocket-id:v2.18.0\n    container_name: pocket-id\n    restart: unless-stopped\n    ports:\n      - \"1411:1411\"\n    volumes:\n      - .\u002Fdata:\u002Fapp\u002Fdata\n    environment:\n      APP_URL: \"https:\u002F\u002Fauth.your-domain.com\"\n      TRUST_PROXY: \"true\"\n```\n\n`APP_URL` must exactly match the public URL of your instance, including the `https:\u002F\u002F` scheme. `TRUST_PROXY: \"true\"` tells Pocket ID to trust the `X-Forwarded-*` headers forwarded by the reverse proxy.",{"title":68,"body":69},"Configure the nginx reverse proxy","Create the nginx vhost for `auth.your-domain.com`. Pocket ID listens on HTTP on port 1411; the reverse proxy handles TLS.\n\n```nginx\nserver {\n    listen 443 ssl http2;\n    server_name auth.your-domain.com;\n\n    ssl_certificate     \u002Fetc\u002Fletsencrypt\u002Flive\u002Fauth.your-domain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fauth.your-domain.com\u002Fprivkey.pem;\n\n    proxy_buffer_size   256k;\n    proxy_buffers       4 512k;\n    proxy_busy_buffers_size 512k;\n\n    location \u002F {\n        proxy_pass         http:\u002F\u002F127.0.0.1:1411;\n        proxy_set_header   Host              $host;\n        proxy_set_header   X-Real-IP         $remote_addr;\n        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;\n        proxy_set_header   X-Forwarded-Proto $scheme;\n    }\n}\n```\n\nObtain the certificate with Certbot before reloading nginx:\n```bash\ncertbot certonly --nginx -d auth.your-domain.com\nnginx -t && systemctl reload nginx\n```",{"title":71,"body":72},"Start the container","From `\u002Fopt\u002Fpocket-id`:\n```bash\ndocker compose up -d\ndocker compose logs -f pocket-id\n```\n\nThe log line `Starting Pocket ID on :1411` confirms the server is ready. Visit `https:\u002F\u002Fauth.your-domain.com` to complete the initial setup.",{"title":74,"body":75},"Create the admin account and register a passkey","On the first visit, Pocket ID prompts you to create the administrator account. Enter your email, then immediately register a passkey: go to **Settings → Passkeys → Add** and follow your browser's prompt (Touch ID, Windows Hello, or a FIDO2 key). Once the passkey is registered, it is the only factor required for subsequent logins.",{"title":77,"body":78},"Register your first OIDC application","In the administration interface, open **OIDC Clients → New client**. Fill in:\n- **Name**: a readable identifier for the application (e.g. `Gitea`)\n- **Callback URL**: the redirect URL declared in the client application (e.g. `https:\u002F\u002Fgit.your-domain.com\u002Fuser\u002Foauth2\u002Fpocket-id\u002Fcallback`)\n\nPocket ID v2.18.0 automatically creates a `client_secret` at creation time — retrieve it immediately, as it will not be displayed in plain text again.\n\nNote the `Client ID` and the discovery URL `https:\u002F\u002Fauth.your-domain.com\u002F.well-known\u002Fopenid-configuration`: these are the two values to enter in the client application.",{"title":80,"body":81},"Test the flow from the client application","In Gitea, go to **Administration → Authentication Sources → Add → OAuth2**. Select `OpenID Connect` as the provider, fill in the `Client ID`, `Client Secret` and the discovery URL. Trigger a test login: the browser should be redirected to `auth.your-domain.com`, prompt for the registered passkey, and then redirect back to Gitea with the user logged in.",{"type":36,"title":83,"body":84},"Post-installation configuration","After the initial setup, a few settings improve the robustness of the instance.",{"type":86,"title":87,"body":88},"tip","Hardening the instance","**Restrict registrations**: by default, Pocket ID allows any visitor to create an account. In production, disable public registration under **Settings → General → Allow registration** and invite users individually.\n\n**Back up the data volume**: all persistence (SQLite database, OIDC signing keys) lives in `.\u002Fdata`. A daily `rsync` to an external storage is sufficient for a small instance. If you migrate to PostgreSQL, add `DB_PROVIDER=postgresql` and `DB_CONNECTION_STRING=...` to your Compose file.\n\n**Pin the image version**: the example above explicitly uses `v2.18.0`. Do not leave `latest` in production — an automatic update can introduce a schema migration that your backup has not yet covered.\n\n**Limit network exposure**: if Pocket ID only needs to be accessible from the VPS internal network, bind port 1411 to the loopback interface and let nginx communicate with the container via the internal Docker network.",{"type":36,"title":90,"body":91},"Troubleshooting","The most common errors when setting up Pocket ID follow well-identified patterns.",{"type":40,"title":93,"items":94},"Common errors and solutions",[95,96,97,98,99],"**502 Bad Gateway on all pages** — most common cause: nginx buffers are too small for Pocket ID's OIDC response headers. Add `proxy_buffer_size 256k`, `proxy_buffers 4 512k` and `proxy_busy_buffers_size 512k` in your `location \u002F` block and reload nginx.","**`redirect_uri_mismatch` during login** — the Callback URL declared in Pocket ID does not exactly match the one sent by the client application. Check for a trailing slash, `http` vs `https` scheme, and the port number. The match must be exact, character for character.","**`invalid_client` at code exchange** — the `client_secret` sent by the application does not match. In v2.18.0, Pocket ID creates a secret automatically at client creation; if you did not save it, regenerate one from the client record in the administration panel.","**Passkey rejected: `NotAllowedError`** — your browser cannot access WebAuthn APIs without HTTPS. Verify that `APP_URL` is set to `https:\u002F\u002F...` and that the TLS certificate is valid (not self-signed, not expired); Certbot must have issued a certificate for the correct domain.","**Sessions are not invalidated after revocation** — back-channel logout requires the client application to declare a `Backchannel Logout URL` in its OIDC record. Without this URL, Pocket ID cannot notify the application; existing sessions will expire at their natural lifetime. Verify the field is filled in and reachable from the Pocket ID container.",{"type":101,"title":102,"headers":103,"rows":109},"comparison","Pocket ID, Authentik, Keycloak, Authelia: which to choose",[104,105,106,107,108],"Criterion","Pocket ID 2.18","Authelia 4.39","Authentik 2026.8","Keycloak 26",[110,116,121,127,133,138,144],[111,112,113,114,115],"IdP protocols","OIDC\u002FOAuth2","OIDC\u002FOAuth2 (beta)","OIDC, SAML 2.0, LDAP, SCIM","OIDC, SAML 2.0, LDAP, Kerberos",[117,118,119,119,120],"Authentication","Passkeys only (FIDO2)","Password + MFA, passkeys","Password + MFA, OTP",[122,123,124,125,126],"RAM at idle","\u003C 50 MB","~30 MB","200–400 MB","1–2 GB",[128,129,130,131,132],"Database","Embedded SQLite (or PostgreSQL)","YAML file (or external backend)","PostgreSQL required","PostgreSQL recommended",[134,135,135,136,137],"Number of containers","1","3 (server, worker, PostgreSQL)","2 (Keycloak + database)",[139,140,141,142,143],"User management","Built-in directory, email invitation","YAML file or external provider","Built-in directory, LDAP, social proxy","Built-in directory, LDAP\u002FAD federation",[145,146,147,148,149],"Best suited for","Lightweight stack, passkeys, simple IdP","Forward-auth layer in front of a proxy","Full SSO, SAML, visual flows","Enterprise SSO, multi-tenant, compliance",{"type":36,"title":151,"body":152},"Conclusion","Pocket ID v2.18.0 answers a specific need: centralising authentication for a self-hosted service stack without the operational cost of Keycloak or Authentik. One container, SQLite, passkeys, and under 50 MB of RAM at idle. Version 2.18.0 adds back-channel logout to invalidate application sessions as soon as an account is revoked, and restores automatic client secret creation to simplify application registration.\n\nIf your stack includes applications that only accept SAML, or if you need to federate an Active Directory, Authentik or Keycloak are better suited. For everything else — modern web services on a 1 or 2 GB VPS — Pocket ID leaves the RAM for other things.\n\nSee also our guides on \u003Ca href=\"\u002Fblog\u002Fself-host-authentik-vps\">Authentik\u003C\u002Fa> and \u003Ca href=\"\u002Fblog\u002Fkeycloak-sso-vps\">Keycloak\u003C\u002Fa> to choose with full information.","Deploy your OIDC provider on VPS","A ServOrbit VPS with Docker 24+ is all you need to run Pocket ID in production. One container, a dedicated IPv4, and your applications secured without any cloud dependency.","Deploy on VPS","\u002Fvps-cloud",[158,176,191],{"id":159,"slug":160,"slugs":161,"title":165,"excerpt":166,"readTime":167,"views":18,"isPinned":19,"publishedAt":168,"updatedAt":169,"category":170,"categories":171,"featuredImage":30,"bgImage":31,"posterImage":173,"relatedSolution":174},192,"self-host-authentik-on-a-vps-open-source-auth0-alternative",{"fr":162,"en":160,"ar":163,"es":164},"self-host-authentik-vps","استضافة-authentik-على-vps-بديل-auth0-مفتوح-المصدر","alojar-authentik-en-un-vps","Self-Host Authentik on a VPS: Open-Source Auth0 Alternative","Deploy Authentik on a ServOrbit VPS for a full IdP (OIDC, SAML 2.0, passkeys, visual flows) to unify authentication across your entire self-hosted stack.",4,"2026-07-26T00:00:00+00:00","2026-09-11T11:34:11+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[172],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fself-host-authentik-vps-poster.svg",{"categorySlug":27,"appSlug":175},"authentik",{"id":177,"slug":178,"slugs":179,"title":183,"excerpt":184,"readTime":167,"views":18,"isPinned":19,"publishedAt":185,"updatedAt":186,"category":187,"categories":188,"featuredImage":30,"bgImage":31,"posterImage":190,"relatedSolution":30},112,"deploy-keycloak-for-sso-on-your-vps",{"fr":180,"en":178,"ar":181,"es":182},"keycloak-sso-vps","نشر-keycloak-لتسجيل-الدخول-الموحد-sso-على-خادمك-vps","desplegar-keycloak-sso-en-un-vps","Deploy Keycloak for SSO on Your VPS","Deploy Keycloak on your VPS for enterprise-grade SSO: OIDC, SAML, realms and federation. A complete Docker guide and comparison.","2026-02-28T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[189],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fkeycloak-sso-vps-poster.svg",{"id":192,"slug":193,"slugs":194,"title":198,"excerpt":199,"readTime":200,"views":201,"isPinned":19,"publishedAt":202,"updatedAt":186,"category":203,"categories":204,"featuredImage":30,"bgImage":31,"posterImage":206,"relatedSolution":207},272,"authentik-authelia-or-keycloak-choosing-your-sso-on-vps",{"fr":195,"en":193,"ar":196,"es":197},"authentik-vs-authelia-keycloak-sso-vps-2026","authentik-أو-authelia-أو-keycloak-اختيار-sso-على-vps","authentik-authelia-o-keycloak-elegir-sso-en-vps","Authentik, Authelia or Keycloak: Choosing Your SSO on VPS","Authentik, Authelia or Keycloak on VPS: compare real memory footprint, covered protocols and Keycloak 26.7.1 CVEs to choose the right self-hosted SSO.",6,1,"2026-08-16T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[205],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fauthentik-vs-authelia-keycloak-sso-vps-2026-poster.svg",{"categorySlug":208,"appSlug":175},"cybersecurity-bastion",1792123569923]