[{"data":1,"prerenderedAt":112},["ShallowReactive",2],{"seo-verification":3,"marketplace-app-en-pocket-id":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"marketplace-app-en-pocket-id",{"slug":9,"slugs":10,"categorySlugs":11,"name":16,"description":17,"phase":18,"unavailableReason":19,"docsUrl":20,"logo":21,"github":21,"tagline":22,"longDescription":23,"features":24,"useCases":31,"steps":41,"faq":57,"specs":73,"compatibleOs":85,"relatedApps":86,"relatedPosts":105,"category":109},"pocket-id",{"fr":9,"en":9,"ar":9,"es":9},{"fr":12,"en":13,"ar":14,"es":15},"cybersecurity","cybersecurity-bastion","الأمن-السيبراني-والحصن","ciberseguridad-bastion","Pocket ID","Self-hosted passwordless OIDC provider — passkey-only authentication in a single Go container. Built-in SQLite, under 50 MB RAM.",2,"awaiting_qa","https:\u002F\u002Fservorbit.com\u002Fblog\u002Fpocket-id-lightweight-oidc-provider-in-one-container",null,"Pocket ID — passkey-only OIDC provider. One Go container, SQLite, under 50 MB RAM, no external database.","Pocket ID is a certified OpenID Connect and OAuth 2.0 provider that handles authentication exclusively through passkeys — no passwords, no SMS codes, no email magic links. Deployed as a single Docker container on your VPS, it secures access to all your self-hosted applications (Gitea, Nextcloud, n8n, Grafana…) with a single passkey: Touch ID, Face ID, Windows Hello or a FIDO2 hardware key.\n\nUnlike Authentik (which orchestrates a full identity lifecycle across organisations) or Keycloak (which embeds a JVM and a database of users), Pocket ID stores everything in a local SQLite file and consumes less than 50 MB of RAM at rest. It is designed for homelab users and small teams who want to centralise authentication across their stack without running a full identity management platform.",[25,26,27,28,29,30],"OpenID Connect Certified™ and OAuth 2.0 provider — works out of the box with any OIDC client library or framework.","Passkeys only — Touch ID, Face ID, Windows Hello and FIDO2 hardware keys (YubiKey…); no password database to manage.","Multi-application SSO — register as many OIDC clients as you want; one passkey unlocks all of them.","Built-in SQLite — no external database to provision, back up or update; all data lives in a single volume.","Under 50 MB RAM at idle — runs on the smallest VPS alongside your other services without competition.","Web admin interface — manage users, OIDC clients and passkeys from a simple dashboard without touching configuration files.",[32,35,38],{"title":33,"body":34},"Single login for your self-hosted stack","Register Gitea, Nextcloud, Grafana and n8n as OIDC clients in Pocket ID. Your users authenticate once with their passkey and access all applications without re-entering credentials.",{"title":36,"body":37},"Secure access for a small team","Add your team members as users in the admin interface. Each person registers their own passkey; Pocket ID controls who can access which application via OIDC client scopes.",{"title":39,"body":40},"Lightweight replacement for a password manager login","Stop managing application-specific passwords. Pocket ID becomes the single front door to your infrastructure: phishing-resistant, hardware-bound, no shared secrets.",[42,45,48,51,54],{"title":43,"body":44},"Create the VPS and point your domain","Order a VPS with Ubuntu 24.04 (512 MB RAM minimum). Pocket ID requires a domain — OIDC mandates HTTPS for redirect URIs. Point your domain or use the free ServOrbit sub-domain (e.g. auth.{dns_slug}.servorbit-dns.com) to the VPS IP before installation.",{"title":46,"body":47},"Install Pocket ID from the Marketplace","In your client area, select Pocket ID, enter your domain and click Install. The script deploys the container, writes the environment variables (including APP_URL) and configures the nginx reverse proxy with HTTPS.",{"title":49,"body":50},"Complete the first-access setup","Visit https:\u002F\u002Fyour-domain, enter your email address and register your first passkey when prompted (Touch ID, Face ID or a FIDO2 key). This step creates the administrator account.",{"title":52,"body":53},"Register your first OIDC client","In the admin interface, open OIDC Clients → New client. Fill in the client name and the callback URL declared in your application (e.g. https:\u002F\u002Fgit.your-domain.com\u002Fuser\u002Foauth2\u002Fpocket-id\u002Fcallback). Pocket ID generates a client ID and secret to copy into your application.",{"title":55,"body":56},"Add more users","In the admin interface, open Users → Invite. Each invited user receives a link to register their own passkey. No passwords, no shared secrets.",[58,61,64,67,70],{"q":59,"a":60},"Does Pocket ID replace a full identity provider like Authentik or Keycloak?","Pocket ID covers one specific use case: passkey-based SSO across applications that support OIDC. It does not provide LDAP, SAML, user provisioning workflows or the enterprise policy engine of Authentik or Keycloak. If you need those features, choose a full IdP. If you need lightweight passkey SSO, Pocket ID is the simpler option.",{"q":62,"a":63},"Is a domain required to deploy Pocket ID?","Yes. OpenID Connect requires HTTPS for redirect URIs — Pocket ID cannot work over plain HTTP or with just an IP address. You can use your own domain or the free ServOrbit sub-domain included with every VPS (https:\u002F\u002Fauth.{dns_slug}.servorbit-dns.com).",{"q":65,"a":66},"Can Pocket ID protect multiple self-hosted applications?","Yes. You register each application as a separate OIDC client in the admin interface (one client ID and secret per application). All clients share the same Pocket ID instance; users authenticate once and access all registered applications.",{"q":68,"a":69},"How do I log in the first time?","Pocket ID shows a setup wizard on first access. Enter your email, then register a passkey (Touch ID, Face ID or a FIDO2 hardware key). This creates the administrator account. Future logins use the passkey directly — no password is ever set.",{"q":71,"a":72},"Does Pocket ID need an external database?","No. Pocket ID stores all data (users, clients, sessions) in a SQLite file inside the Docker volume. No PostgreSQL or MySQL instance is required. Back up the \u002Fapp\u002Fdata volume to preserve your configuration.",{"ram":74,"cpu":75,"disk":76,"stack":77,"port":81,"license":82,"version":83,"os":84},"512 MB minimum (\u003C 50 MB idle)","1 vCPU","1 GB",[78,79,80],"Docker","Go","SQLite","1411","Apache-2.0","v2.18.0","Ubuntu 24.04",[],[87,95,100],{"name":88,"slug":89,"categorySlug":13,"categoryName":90,"categoryColor":91,"logo":92,"tagline":93,"description":94},"Authelia","authelia","Cybersecurity & Bastion","text-red-400 bg-red-500\u002F10","https:\u002F\u002Fcdn.simpleicons.org\u002Fauthelia","Add MFA, SSO and fine-grained access control in front of any app — no code changes required.","Open-source authentication and authorization gateway — add MFA, SSO and fine-grained access control in front of any app without touching its code.",{"name":96,"slug":97,"categorySlug":13,"categoryName":90,"categoryColor":91,"logo":21,"tagline":98,"description":99},"Authentik","authentik","Self-hosted Auth0 alternative — full IdP with OIDC, SAML, LDAP, passkeys and a visual flow editor.","Open-source self-hosted identity platform: manage users, SSO, OIDC\u002FSAML, passkeys and custom authentication flows — an Auth0 and Okta alternative on your VPS.",{"name":101,"slug":102,"categorySlug":13,"categoryName":90,"categoryColor":91,"logo":21,"tagline":103,"description":104},"ZITADEL","zitadel","Manage identities, SSO and permissions self-hosted, ready in 5 minutes.","Open-source developer-first IAM platform: identity management, SSO OIDC\u002FOAuth 2.0, passkeys, and native multi-tenancy. A lightweight alternative to Keycloak for dev teams.",[106,107,108],"self-host-authentik-vps","self-host-logto-vps","self-host-authelia-vps",{"key":110,"slug":13,"name":90,"objective":111,"icon":110,"color":91},"security","Harden infrastructure security.",1792361229645]