Pocket ID
Pocket ID is a lightweight, self-hosted OpenID Connect Certified™ and OAuth 2.0 identity provider that enables passwordless authentication via passkeys for self-hosted applications. It runs as a single Docker container or binary, integrates with any OIDC-compatible app, and includes features like LDAP sync, group-based access control, and OAuth support for MCP servers and AI tools.
- Cybersecurity
- Software Only
- Artificial Intelligence
- Developer Tools
Funding
Founders
Founder details are not available yet.
Product
Problem
Self-hosted application owners need an identity provider to secure access to their services, but mainstream solutions like Keycloak or Authentik are often too complex and resource-intensive for simple use cases. Additionally, traditional password-based authentication introduces security risks and friction for users managing multiple self-hosted applications.
Solution
Pocket ID is a simple, lightweight OpenID Connect Certified™ and OAuth 2.0 provider that allows users to authenticate to self-hosted services using passkeys instead of passwords. The platform focuses on ease of deployment and minimal resource usage, enabling administrators to set up and configure the service quickly, with deployment as a single Docker container or binary. By exclusively supporting passkey authentication, Pocket ID eliminates the need for password management while allowing the use of hardware security keys such as YubiKeys, with passkeys unlocking via fingerprint, face scan, or PIN. The system integrates with any application that supports the OIDC standard, providing a streamlined and secure sign-in experience across a user's entire self-hosted ecosystem. It also includes features like LDAP/Active Directory sync, group-based access control, and OAuth support for MCP servers and AI tools.
Target Audience
Primary users are self-hosting enthusiasts, homelab administrators, small teams, and startups who need a simple, secure, and low-maintenance identity provider for their personal applications and services, without the overhead of enterprise-grade solutions like Keycloak or Authentik.
Features
- Passkey-first authentication with support for hardware security keys like YubiKeys, removing the need for passwords entirely
- Lightweight architecture that runs as a single Docker container or binary with very few system resources, suitable for low-power hardware or VPS instances
- Standards-based OIDC integration with OpenID Connect Certified™ status, compatible with all applications that support the protocol
- LDAP and Active Directory synchronization for importing and keeping users and groups in sync
- Group-based access controls to restrict which users can sign in to which clients, with groups passed in tokens for role assignment
- OAuth 2.0 authorization server support for MCP servers and AI tools, letting clients get tokens limited to granted scopes
- Full REST API for scripting and provisioning, including user and OIDC client management, with stable error codes and request IDs for debugging
- Audit log that records every sign-in with device, IP address, and approximate location
- Demo instance for testing and SBOM (Software Bill of Materials) generation for supply chain security
- One-time login codes for initial user onboarding
- Push group changes to SCIM
- Rate limiting and SSRF protection for enhanced security