Pocket ID

Open source alternative to Auth0 and Okta

10K stars
BSD-2-Clause
Active this week
Last commit today

Last verified Nov 5, 2026

Secure your apps with a self-hosted, OpenID Connect Certified provider that uses passkeys instead of passwords.

Visit website GitHub10K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs and the FAQ

who it's for

Who Pocket ID is for#

Homelab operators centralizing sign-in

Run one Pocket ID instance and connect every OIDC-compatible self-hosted service through it. Users sign in once with a passkey and access every connected app without separate credentials per service.

Skip if:

You run only one or two apps and direct username/password in each is acceptable. The setup overhead of a central auth server pays off at three or more connected services.

Small teams replacing Auth0 or Okta

Teams that have outgrown per-user identity provider pricing and have the infrastructure to run a self-hosted service. Pocket ID adds LDAP and SCIM so it integrates with existing directories, and audit logs cover the compliance basics for most small-team deployments.

Skip if:

Your team needs advanced features such as step-up MFA policies, fine-grained risk scoring, or SAML 2.0 federation. Pocket ID covers standard OIDC and OAuth 2.0 flows, not the broader enterprise IAM surface.

Developers integrating OIDC into their applications

Add OIDC-based sign-in to an application without building an identity server. Pocket ID's REST API manages users, groups, and clients programmatically, and federated client credentials support Kubernetes and CI workloads.

Skip if:

Your app targets a broad consumer audience where users will not have a Pocket ID account. It is a self-hosted provider for a controlled set of users, not a social login option.

the problem

The problem it solves#

Most hosted identity providers charge per monthly active user, which adds up fast even for small teams running services internally. Keycloak and similar open source providers are genuinely capable but their configuration surface assumes a dedicated IAM engineer, not a developer who wants SSO across six self-hosted apps.

Passkeys are now supported natively by every major password manager and hardware key, but setting up an OIDC provider that skips passwords while staying easy to administer has not been a simple task. Existing options either carry more operational overhead than a small team can maintain or lock users into a commercial service billing by headcount.

how Pocket ID solves it

How it solves it#

Passkeys as the only credential type

Pocket ID has no password field. Users add passkeys from a device, password manager (1Password, Apple Passwords, Google Password Manager), or hardware key (YubiKey). New users receive a one-time login code or link to add their first passkey, and each user manages their own passkeys from a self-service panel.

OpenID Connect Certified and OAuth 2.0

Pocket ID holds the official OpenID Connect Certified mark for the basic OP profile. Any application that works with an OIDC provider connects to Pocket ID without code changes, and clients receive OAuth 2.0 access tokens scoped to the permissions they were granted.

LDAP and Active Directory sync

Import users and groups from an LDAP server or Active Directory and keep them in sync automatically. Teams already running Active Directory can use it as the user source without migrating accounts into Pocket ID.

SCIM provisioning

Create and remove user accounts in connected applications as you change them in Pocket ID. SCIM removes the manual step of updating app-side user lists when someone joins or leaves the organization.

Federated client credentials

Workloads on Kubernetes, GitLab CI, or Azure can authenticate to Pocket ID without storing a client secret. The workload's platform identity is federated, so tokens are issued based on the workload's native credential rather than a shared secret.

OAuth authorization for MCP servers

Pocket ID acts as the OAuth authorization server for remote Model Context Protocol servers and other AI tool integrations. Users approve access with their passkey, and each client receives a token scoped to what it was granted.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Single binary with SQLite built inPocket ID ships as a single Go binary with SQLite embedded, so there is no separate database process to run for most deployments. PostgreSQL is supported when needed. Community members report running it comfortably on a low-spec VPS, which makes it a low-overhead addition to any self-hosted stack.
No password storage, no reset flowBecause Pocket ID accepts passkeys only, there is no password database to protect, no reset email flow to maintain, and no credential stuffing risk. The attack surface for credential theft is eliminated at the architecture level.
10,000-star adoption with active developmentOver 10,000 GitHub stars and 350 forks in roughly two years, with commits through November 2026. The r/selfhosted community consistently ranks it among the easiest auth tools to deploy, with users reporting two-hour setup times from scratch to all apps connected.
BSD-2-Clause license with no commercial restrictionsBSD-2-Clause is a permissive OSI-approved license. Run Pocket ID commercially, modify it, and distribute it without copyleft obligations, enterprise license fees, or dual-licensing restrictions.

Trade-offs

-Passkeys are the only credential typePocket ID has no password fallback. Users on devices or browsers without passkey support must use the one-time login code path to add their first passkey. Environments with strict compliance requirements should verify that passkey sign-in satisfies their authentication policy before deploying.
-97 open GitHub issuesThe repository carries 97 open issues as of November 2026. The project moves quickly, with the last push on November 4, 2026, so the queue reflects active triage rather than stagnation, but users should check open issues related to their specific integration before deploying to production.

versus alternatives

Pocket ID vs alternatives#

Pocket ID vs Auth0

Auth0 is a managed identity platform that handles authentication as a hosted service. Both implement OpenID Connect, but their deployment models differ: Auth0 is SaaS-only while Pocket ID runs on your own infrastructure.

Feature	Pocket ID	Auth0
License	BSD-2-Clause	Proprietary
Self-hosting	Yes	No
Credential type	Passkeys only	Passwords, social login, MFA
SAML support	No	Yes
SCIM provisioning	Yes	Yes

Pocket ID is the better choice for teams with a known, internal user base who want SSO across OIDC-compatible services without managed-service costs. Auth0 fits when your application serves public users with varied identity providers, when SAML is required, or when managed identity infrastructure is preferable to running your own server.

Pocket ID vs Okta

Okta is an enterprise identity platform focused on workforce identity management at scale. Pocket ID targets a smaller scope: self-hosted environments, homelabs, and small teams that want OIDC SSO without enterprise IAM complexity.

Feature	Pocket ID	Okta
License	BSD-2-Clause	Proprietary
Self-hosting	Yes	No
Credential type	Passkeys only	Passwords, MFA, SSO
SAML support	No	Yes
LDAP sync	Yes	Yes

Pocket ID covers OIDC and OAuth 2.0 for small-scale self-hosted stacks with minimal administrative overhead. Okta is worth considering when your organization needs enterprise IAM governance, risk-based authentication policies, or SSO across a broad catalog of commercial SaaS applications.

tech stack · detected from GitHub

What it's built on#

Languages: GoTypeScript
Frameworks: ReactSvelte
Tooling: Rollup

frequently asked

FAQ#

How does Pocket ID differ from Keycloak?

Pocket ID's design goal is simplicity for small-to-medium self-hosted deployments. Keycloak covers a much larger surface (SAML 2.0, enterprise federation, and complex multi-tenant configuration) but that breadth adds configuration complexity. Pocket ID covers OIDC, OAuth 2.0, LDAP sync, SCIM, and passkeys in a single binary that runs as a Docker container or standalone Go binary, with SQLite embedded and no external database required. One r/selfhosted user reported having it running with all their OIDC apps configured in under two hours. If you need SAML or complex enterprise IAM, Keycloak is the better fit; if you need OIDC SSO across self-hosted apps with minimal overhead, Pocket ID is the simpler path.

Does Pocket ID support SAML?

No. Pocket ID covers OpenID Connect and OAuth 2.0 only and holds the OpenID Connect Certified mark for the basic OP profile. If SAML is required for your environment, Keycloak and Authentik both support SAML 2.0 alongside OIDC.

What database does Pocket ID use?

SQLite by default, embedded in the binary with no separate database process needed. PostgreSQL is also supported for deployments that prefer a managed database or need higher write throughput.

Is Pocket ID free for commercial use?

Yes. Pocket ID is BSD-2-Clause licensed, a permissive OSI-approved license. You can run it commercially, modify it, and distribute it without paying fees or sharing source changes. There is no enterprise tier or commercial license requirement.

How do new users sign in if they have not set up a passkey yet?

Pocket ID sends a one-time login code or link so the user can authenticate and add their first passkey. After the first passkey is added, all future sign-ins use it. Supported passkey sources include password managers (1Password, Apple Passwords, Google Password Manager) and hardware keys (YubiKey).

also worth a look