Pocket ID
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| MITPermissive license. Preserve the copyright notice. Applies only to the covered code — your surrounding project can stay under any license. | — | Active | ✅ | Unlimited | ❌ |
Description
Pocket ID is a self-hosted OIDC provider that supports only passwordless authentication via passkeys (WebAuthn). No passwords, no magic links — users authenticate with their device biometrics or hardware key. It connects to the same ecosystem of OIDC-compatible apps as Rauthy or Authentik.
Features
- Passkey-only authentication — WebAuthn, device biometrics, or a hardware key; no password field exists to phish or forget.
- Small footprint, simple setup — lighter than Authentik while covering the OIDC use case well.
Usage patterns
- Passkey-comfortable user base — for a community or organisation already comfortable with passkeys, keeps things clean and opinionated rather than offering multiple fallback methods to configure and secure.
- Not for a mixed user base — passkey-only is a hard constraint; anyone without a compatible device or browser is locked out, with no fallback authentication method available.
License and governance
MIT — permissive, no restrictions on self-hosting or modification.
Conclusion
Why you would — passwordless is more secure and often simpler for end users — no password to forget, no credential to phish — with a smaller footprint and simpler setup than Authentik while still covering the OIDC use case well.
Why you wouldn't — passkey-only is a hard constraint, not a preference: anyone without a compatible device or browser is locked out entirely, with no fallback. Not suitable for a mixed user base — Rauthy or Authentik are better fits there.