Skip to content

Self-host Pocket ID

updated Aug 2026prices checked · Aug 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test

A simple, self-hostable OIDC provider that lets users sign in to your apps with passkeys only — no passwords, built for small self-hosted setups that just need lightweight SSO.

Key facts

CategorySSO & Identity
LicenseBSD-2-Clause
StackGo, SvelteKit
Min RAM256 MB
Dockeryes
Difficulty
Our recommendation

Pick Pocket ID when you want dead-simple passkey login for your own services and nothing more — it's a small, focused OIDC provider built around passkeys, not a full identity suite. If you need passwords, user federation, or enterprise protocols, it's the wrong tool and authentik or Keycloak are right.

What you need

  • Any VPS with at least 256 MB of RAM
  • A domain you control — most self-hosted setups need HTTPS in front of them
  • Under an hour if you've used Docker before

Install

Run these commands on your server:

# Pocket ID — official compose + env template
curl -o docker-compose.yml https://raw.githubusercontent.com/pocket-id/pocket-id/main/docker-compose.yml
curl -o .env https://raw.githubusercontent.com/pocket-id/pocket-id/main/.env.example
# the template ships ENCRYPTION_KEY empty — v2 refuses to boot without one:
sed -i "s|^ENCRYPTION_KEY=$|ENCRYPTION_KEY=$(openssl rand -base64 32)|" .env
docker compose up -d  #  →  http://SERVER_IP:1411/setup
vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Pocket ID is deliberately minimal, so adopt it for what it is, not what it isn't:

non-negotiableIt's passkey-only by design. There are no passwords — every user needs a passkey-capable device, which is the point but also a hard constraint to plan around.
non-negotiableIt's a small, young project. Effectively single-maintainer and narrow in scope — fine for personal services, riskier as the login for anything you can't afford to have stall.
non-negotiableIt's OIDC-only. It speaks OpenID Connect and little else — apps that need SAML or LDAP won't work with it.

Head-to-head

SSOAug 2026
Pocket ID
vs
authentik

A full identity platform vs. a passkey-only sign-in box.

Read the verdict →

More in SSO & Identity

SSO & Identity

Authelia

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.
Go
moderateRead guide →
SSO & Identity

authentik

An open-source identity provider supporting SAML, OAuth2/OIDC, and LDAP — a flexible, self-hostable alternative to Auth0, Okta, and Azure AD with a visual flow-based login builder.
PythonGoTypeScript
moderateRead guide →
SSO & Identity

Keycloak

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.
JavaQuarkus
hardRead guide →
SSO & Identity

Tinyauth

The tiniest self-hosted login screen for your apps — a single small Go container that adds authentication, OAuth login, and access controls in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider.
Go
easyRead guide →

We use analytics cookies (Google Analytics, PostHog) to see which guides are useful. No ad networks, no cross-site tracking. See our privacy policy.