Pocket ID is a self-hosted, OpenID Connect Certified™ and OAuth 2.0 provider, written in Go, that authenticates users with passkeys and passwords never, aimed at anyone who wants single sign-on for their own applications without standing up a heavyweight identity platform.

What it is

Pocket ID is an identity provider (IdP) that speaks OpenID Connect and OAuth 2.0, the two protocols applications use to delegate sign-in to a central authority. It lives in the self-hosted identity and access management ecosystem, alongside tools such as Keycloak and ORY Hydra, and it is distributed under the BSD-2-Clause licence. The project's stated goal is to be simple and easy to use. Its distinguishing design decision is that it supports passkey authentication only, which means there is no password to set, store, reset or leak.

The concrete problem it solves is complexity in simple deployments. The README states plainly that other self-hosted OIDC and OAuth 2.0 providers like Keycloak or ORY Hydra are often too complex for simple use cases. Pocket ID replaces that class of general-purpose identity server with a narrower one: a certified OIDC and OAuth 2.0 provider that does passkeys and little else, so the operator configures an issuer and registers clients rather than modelling realms, federated identity flows and password policies. Because authentication is passkey-only, the credential material lives on the user's device or hardware key rather than in the provider's database.

Key capabilities

• Acts as an OpenID Connect Certified™ provider and an OAuth 2.0 provider, so standard OIDC and OAuth 2.0 clients can register against it.
• Authenticates users exclusively with passkeys, which removes passwords from the login flow entirely.
• Supports hardware authenticators for sign-in: the README gives the example of using a physical Yubikey to sign in to all of your self-hosted services easily and securely.
• Ships as a self-hosted service, so the operator runs the identity provider inside their own environment.
• Deploys via Docker, which the README names as the easiest and recommended setup method.
• Provides a public demo instance at https://demo.pocket-id.org for trying the flow before deploying.
• Is implemented in Go and released under BSD-2-Clause, with setup and further information in the documentation at https://docs.pocket-id.org.

Who uses it and how

• Self-hosters running a collection of personal services who need one login across all of them; the README's Yubikey example is exactly this scenario.
• Small teams and simple deployments where a full identity platform is more configuration surface than the problem warrants.
• Operators whose users already hold passkey-capable devices or hardware security keys and who want passwordless sign-in without managing password resets.
• Administrators evaluating the project against the hosted demo at https://demo.pocket-id.org before committing to a self-hosted instance.
• Anyone running services that already speak OIDC or OAuth 2.0 and can point them at a new issuer without custom integration work.

Getting started

Setup can be done in multiple ways, but the easiest and recommended method is Docker. The setup guide and further information live in the documentation at https://docs.pocket-id.org.

How it compares

The README names Keycloak and ORY Hydra as the comparable self-hosted OIDC and OAuth 2.0 providers, and positions Pocket ID against them on one axis: complexity versus simplicity for straightforward use cases. Pocket ID does less, deliberately. Where Keycloak and ORY Hydra offer broad configuration for general identity workloads, Pocket ID restricts itself to passkey-only authentication, which is the trade that makes it small. It is BSD-2-Clause licensed and self-hosted, so the operator keeps the deployment and the user credentials stay on user devices as passkeys rather than as a password store under the operator's control.

When to use it — and when not to

Choose Pocket ID when the requirement is a small, self-hosted OIDC and OAuth 2.0 provider and every user can present a passkey. Do not choose it if any user population needs password authentication, password recovery flows or credential types other than passkeys; passkey-only is the project's deliberate design, not a configuration toggle, and the README acknowledges that some people might not like this idea at first. The README itself is compact and defers setup detail to the external documentation, so a self-hoster should expect to work from https://docs.pocket-id.org rather than from the repository alone. The project is actively maintained, with a recent push and 98 open issues, but that issue count is worth reviewing against your own deployment needs before committing.