Self-host Pocket ID

updated Aug 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

A simple, self-hostable OIDC provider that lets users sign in to your apps with passkeys only — no passwords, built for small self-hosted setups that just need lightweight SSO.

Key facts

CategorySSO & Identity

LicenseBSD-2-Clause

StackGo, SvelteKit

Min RAM256 MB

Official imageyes

Measured idle RAM14 MB

Difficulty

Sourcegithub.com/pocket-id/pocket-id

Websitepocket-id.org

Our recommendation

Pick Pocket ID when you want dead-simple passkey login for your own services and nothing more — it's a small, focused OIDC provider built around passkeys, not a full identity suite. If you need passwords, user federation, or enterprise protocols, it's the wrong tool and authentik or Keycloak are right.

Follow the Pocket ID deploy guide →

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
Under an hour if you've used Docker before

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# Pocket ID — official compose + env template
curl -o docker-compose.yml https://raw.githubusercontent.com/pocket-id/pocket-id/main/docker-compose.yml
curl -o .env https://raw.githubusercontent.com/pocket-id/pocket-id/main/.env.example
# the template ships ENCRYPTION_KEY empty — v2 refuses to boot without one:
sed -i "s|^ENCRYPTION_KEY=$|ENCRYPTION_KEY=$(openssl rand -base64 32)|" .env
docker compose up -d  #  →  http://SERVER_IP:1411/setup

deploy guideHow to Deploy Pocket ID on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Pocket ID is deliberately minimal, so adopt it for what it is, not what it isn't:

non-negotiableIt's passkey-only by design. There are no passwords — every user needs a passkey-capable device, which is the point but also a hard constraint to plan around.

non-negotiableIt's a small, young project. Effectively single-maintainer and narrow in scope — fine for personal services, riskier as the login for anything you can't afford to have stall.

non-negotiableIt's OIDC-only. It speaks OpenID Connect and little else — apps that need SAML or LDAP won't work with it.