Is a domain required to deploy Pocket ID?

Yes. OpenID Connect requires HTTPS for redirect URIs — Pocket ID cannot work over plain HTTP or with just an IP address. You can use your own domain or the free ServOrbit sub-domain included with every VPS (https://auth.{dns_slug}.servorbit-dns.com).

Can Pocket ID protect multiple self-hosted applications?

Yes. You register each application as a separate OIDC client in the admin interface (one client ID and secret per application). All clients share the same Pocket ID instance; users authenticate once and access all registered applications.

How do I log in the first time?

Pocket ID shows a setup wizard on first access. Enter your email, then register a passkey (Touch ID, Face ID or a FIDO2 hardware key). This creates the administrator account. Future logins use the passkey directly — no password is ever set.

Does Pocket ID need an external database?

No. Pocket ID stores all data (users, clients, sessions) in a SQLite file inside the Docker volume. No PostgreSQL or MySQL instance is required. Back up the /app/data volume to preserve your configuration.

Harden infrastructure security.

Pocket ID

Pocket ID — passkey-only OIDC provider. One Go container, SQLite, under 50 MB RAM, no external database.

512 MB minimum (< 50 MB idle) RAM 1 vCPU Port 1411 In validation

In validation

Automatic installation for this solution is ready and currently going through our tests on a real server. Ordering will open as soon as validation is complete.

Tech stack

DockerGoSQLite

Minimum RAM512 MB minimum (< 50 MB idle)

Minimum CPU1 vCPU

Default port1411

Compatible OSChoice of Linux distributions

Pocket ID is a certified OpenID Connect and OAuth 2.0 provider that handles authentication exclusively through passkeys — no passwords, no SMS codes, no email magic links. Deployed as a single Docker container on your VPS, it secures access to all your self-hosted applications (Gitea, Nextcloud, n8n, Grafana…) with a single passkey: Touch ID, Face ID, Windows Hello or a FIDO2 hardware key.

Unlike Authentik (which orchestrates a full identity lifecycle across organisations) or Keycloak (which embeds a JVM and a database of users), Pocket ID stores everything in a local SQLite file and consumes less than 50 MB of RAM at rest. It is designed for homelab users and small teams who want to centralise authentication across their stack without running a full identity management platform.

Key features

OpenID Connect Certified™ and OAuth 2.0 provider — works out of the box with any OIDC client library or framework.

Passkeys only — Touch ID, Face ID, Windows Hello and FIDO2 hardware keys (YubiKey…); no password database to manage.

Multi-application SSO — register as many OIDC clients as you want; one passkey unlocks all of them.

Built-in SQLite — no external database to provision, back up or update; all data lives in a single volume.

Under 50 MB RAM at idle — runs on the smallest VPS alongside your other services without competition.

Web admin interface — manage users, OIDC clients and passkeys from a simple dashboard without touching configuration files.

When to use this solution?

1

Single login for your self-hosted stack

Register Gitea, Nextcloud, Grafana and n8n as OIDC clients in Pocket ID. Your users authenticate once with their passkey and access all applications without re-entering credentials.

2

Secure access for a small team

Add your team members as users in the admin interface. Each person registers their own passkey; Pocket ID controls who can access which application via OIDC client scopes.

3

Lightweight replacement for a password manager login

Stop managing application-specific passwords. Pocket ID becomes the single front door to your infrastructure: phishing-resistant, hardware-bound, no shared secrets.

Deploy Pocket ID on your VPS

Guide optimized for ServOrbit Cloud VPS.

01

Create the VPS and point your domain

Order a VPS with Ubuntu 24.04 (512 MB RAM minimum). Pocket ID requires a domain — OIDC mandates HTTPS for redirect URIs. Point your domain or use the free ServOrbit sub-domain (e.g. auth.{dns_slug}.servorbit-dns.com) to the VPS IP before installation.

02

Install Pocket ID from the Marketplace

In your client area, select Pocket ID, enter your domain and click Install. The script deploys the container, writes the environment variables (including APP_URL) and configures the nginx reverse proxy with HTTPS.

03

Complete the first-access setup

Visit https://your-domain, enter your email address and register your first passkey when prompted (Touch ID, Face ID or a FIDO2 key). This step creates the administrator account.

04

Register your first OIDC client

In the admin interface, open OIDC Clients → New client. Fill in the client name and the callback URL declared in your application (e.g. https://git.your-domain.com/user/oauth2/pocket-id/callback). Pocket ID generates a client ID and secret to copy into your application.

05

Add more users

In the admin interface, open Users → Invite. Each invited user receives a link to register their own passkey. No passwords, no shared secrets.

Frequently asked questions

Pocket ID covers one specific use case: passkey-based SSO across applications that support OIDC. It does not provide LDAP, SAML, user provisioning workflows or the enterprise policy engine of Authentik or Keycloak. If you need those features, choose a full IdP. If you need lightweight passkey SSO, Pocket ID is the simpler option.

Complementary solutions

Cybersecurity & Bastion

Pocket ID isn't orderable yet.