authentik vs Pocket ID

authentik and Pocket ID both let you self-host sign-in for your apps, but they sit at opposite ends of what "identity provider" can mean. authentik is a full identity platform — passwords, MFA, SAML, LDAP, a user directory, and a visual flow builder for assembling login steps. Pocket ID is deliberately narrow: a single OIDC provider that only does passkeys, with no passwords anywhere in the system, built for people who want passkey sign-in and nothing else to configure. The decision is really about how much identity platform you actually need.

A full IdP vs. a single-purpose passkey box

authentik's scope is broad on purpose. It speaks OIDC, OAuth2, SAML, LDAP, and SCIM; it ships a proxy provider for apps with no native SSO support at all; it keeps a real user directory with enrollment, recovery, and group-based claims; and its flow builder lets you compose multi-step login logic — password, then MFA, then consent — visually. It is built to be the one place identity lives for a stack of self-hosted apps, some of which speak modern protocols and some of which don't.

Pocket ID has none of that ambition, and that's the feature. It is a Go and SvelteKit application that does exactly one thing: it is an OIDC provider where every account signs in with a passkey. There are no passwords in the system — not "passwords are optional," but no password field exists at all. There's no SAML, no LDAP, no proxy provider, no flow builder. What you get is an OIDC endpoint any app that supports OIDC login can point at, and an admin screen for managing which passkey belongs to which user.

Footprint

This is where the gap stops being architectural and becomes practical. authentik's official Compose stack — server, worker, PostgreSQL, Redis — carries a documented floor of 2 GB of RAM. Pocket ID is a single container with a documented floor of 256 MB, already an eighth of authentik's number before you measure anything.

Measured idle at first boot widens the gap further: a fresh authentik instance settles at ~516 MB, Pocket ID at ~16 MB — roughly a 32x difference, and both numbers sit well under their documented minimums since neither has real traffic or a warmed cache yet. If your whole requirement is passkey login for two or three self-hosted apps, that difference is the whole story: it's the difference between a service that rides along on spare capacity and one that needs its own line item in your resource budget.

What you give up by going minimal

Pocket ID's minimalism is a real trade, not a free lunch. There is no password fallback if a user loses every passkey and has no recovery method set up — you handle that manually as the admin. There's no SAML for the legacy enterprise app that only speaks it, Pocket ID is not an LDAP provider for apps that want to bind against a directory, and there's no proxy provider for software that has no SSO support of its own. What it doesn't have is authentik's policy machinery — there's no flow builder, no multi-step conditional login logic, no enrollment or recovery flows to design. Groups exist and can gate which clients a user may sign into, but that one mechanism is the whole authorization story.

None of that is a defect in Pocket ID; it's the same design decision that gets you to 16 MB. The question is whether your apps and your requirements fit inside that scope.

Setup and day-to-day admin

authentik's admin surface is the bigger of the two by design: applications are registered through forms, flows are assembled visually, and a scoped admin role can reasonably be handed to someone who isn't you. That's overhead worth paying once more than one person needs to manage access, or once the login logic itself needs branching — require MFA for one group, skip it for another, chain an external IdP before password entry.

Pocket ID's admin screen is much smaller: users, their groups and passkeys, and the OIDC clients each group is allowed to sign into. There's nothing to compose because there's only one path through — register a passkey, sign in with it. That's a feature for a single administrator running a handful of personal services, and a limitation the moment the login logic itself needs to branch the way authentik's flows can.

For homelab vs. for teams

For a homelab built around passkey-first sign-in — a handful of self-hosted services, one or two people, apps that all speak OIDC — Pocket ID is very hard to beat. It rates 2 out of 5 to deploy against authentik's 3 out of 5, there's no flow to configure because there's only one flow, and the resource cost is close to zero.

For a team, or for any setup where even one app needs SAML or an LDAP endpoint to bind against, or where you want a real identity platform with enrollment, recovery, and per-flow policy rather than a single passkey path, authentik's breadth stops being overhead and becomes the actual requirement. Paying 2 GB and three extra containers is the cost of that breadth, not a tax layered on top of it.

Licensing

authentik is MIT at the core, with an open-core enterprise tier adding remote access, risk detection, and support on top of a free edition that already covers SSO, MFA, LDAP, SAML, OIDC, and the proxy provider. Pocket ID is BSD-2-Clause — about as permissive as licenses get, with no commercial tier at all. Neither raises a licensing concern for a self-hoster; the difference is business model, not restriction.

Who should pick neither

If you need SSO in front of apps that have no login system at all — think static dashboards, admin tools with no auth of their own — neither of these is quite the shape you want out of the box, since Pocket ID has no forward-auth mode and authentik's proxy provider, while it covers this case, is a lot of platform to bring in for it alone. Authelia or Tinyauth are built specifically as forward-auth gates for a reverse proxy — see Authelia vs. authentik and authentik vs. Tinyauth for how they compare to the full-IdP option.

Choosing between Pocket ID and authentik

Starting from Pocket ID's side changes the framing but not the answer: pick it when the entire requirement is passkey-only sign-in for apps that already speak OIDC, and you want the smallest possible thing that could work — a single container, no password reset flow to secure, no directory to maintain. The moment your list grows to include SAML, LDAP, a proxy for legacy apps, or accounts that need group-based permissions, you've outgrown Pocket ID's scope by design, and authentik is the tool built for that list. Most self-hosted setups end up needing at least one item off that list eventually, which is why authentik is the default here — but if today's requirement really is "passkeys, and only passkeys," Pocket ID does that job in 16 MB and nothing more.

Running either on a VPS

Pocket ID's footprint is small enough to run comfortably alongside almost anything else on a shared VPS — a single container with a lightweight database is not going to be the thing that determines your instance size. authentik needs more deliberate planning: budget for its full Compose stack (server, worker, Postgres, Redis) rather than the bare documented minimum, and back up the Postgres volume, since it holds every user, credential, and flow you've configured. Either fits on any of the VPS options here; the step-by-step install guides are linked below.