Pocket ID

Pocket ID is a self-hostable identity provider built around one idea: passwordless sign-in should be simple to run and simple to use. It's OpenID Connect Certified and OAuth 2.0 compliant, so it works with any app that supports OIDC. Users authenticate with passkeys rather than passwords, which removes the weakest link in most authentication setups.

The self-hosted identity space has heavier options like Keycloak, Authentik, and Zitadel. Pocket ID sits at the opposite end of that spectrum. It does less, but what it does is fast to configure and light on resources. Community reports consistently mention getting from zero to fully connected apps in a couple of hours.

Key capabilities include:

• Passkey-only authentication – no password fallback, no complexity around credential resets
• Group-based access control – restrict which user groups can sign in to each registered application
• LDAP sync – pull users and groups from an existing directory rather than managing them separately
• SCIM provisioning – automatically provision and deprovision users in connected apps
• API resource indicators – issue scoped OAuth tokens tied to a specific API and its allowed actions
• Metadata-based OAuth clients – connect compatible clients via a hosted metadata document without manual registration
• QR code cross-device sign-in – approve a login on a device that holds your passkey by scanning a QR code
• Audit logs – per-user and global logs covering important authentication events
• REST API – manage users, clients, and configuration programmatically

It also works as an OAuth provider for AI applications and remote MCP servers, letting users approve access with a passkey while scoped tokens limit what each client can reach.

Over 25 language translations are available, and the project runs on over 13,000 active instances. It's a practical fit for homelabs, small teams, and anyone who wants one passwordless login across all their self-hosted services without running a full-featured identity platform.