9.0k stars · BSD-2-Clause · v2.14.0 (2026-08-18), re-read from /releases/latest on 2026-09-12 · Track this in Scout
A small OIDC identity provider that signs people in with passkeys and nothing else.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Pocket ID is an identity provider. That means other programs hand the sign-in step over to it, and it tells them who the person is. It supports passkeys only, which are the keys your phone or computer stores for you and unlocks with a fingerprint, a face or a PIN.
What it is good for. A solo builder who has one or two private tools on a server and wants a proper login in front of them. It is also a real answer for a product's own sign-in page. Edition 11 recommended Logto for the same job. Logto does far more, including passwords, social logins and organisations, and it is the right choice if you need those. Pocket ID is the right choice if you want one small program that does one thing and finishes in an evening. If a sign-in page is still on the to-do list, these two are the choice to make.
- No passwords to store, reset, or have stolen.
- It is one small program with a small database, so it is cheap to run and easy to understand.
- It speaks the standard sign-in language, so most self-hosted tools accept it without changes.
- It only works over HTTPS, because passkeys refuse to run otherwise. You need entry 3 or a similar arrangement first.
- Passkeys are tied to devices. Losing every device you own is a real support problem, so set up more than one and keep a recovery route.
- Passkey-only means some visitors on older phones or shared computers will struggle. That is a product decision, not a bug.
mkdir -p ~/pocket-id && cd ~/pocket-id
cat > docker-compose.yml <<'EOF'
services:
pocket-id:
image: ghcr.io/pocket-id/pocket-id:v2
restart: unless-stopped
env_file: .env
ports:
- '127.0.0.1:1411:1411'
volumes:
- ./data:/app/data
EOF
echo "APP_URL=https://id.example.com" > .env
echo "TRUST_PROXY=true" >> .env
docker compose up -d
