A deliberately smaller identity provider
Pocket ID gives self-hosted applications a central login without asking the operator to learn a full enterprise identity suite. It speaks OpenID Connect and OAuth 2.0, has passed OpenID provider certification, and makes passkeys the normal way every user authenticates. Applications redirect to Pocket ID, the user approves with a device, password manager, or hardware key, and the application receives standard identity tokens.
That narrow choice is the product. There is no password database to protect or reset, and a passkey's private material stays on the user's authenticator. Credentials are bound to the Pocket ID site, which makes ordinary phishing much harder. A phone can also approve a five-minute QR login on another device. For a home lab full of OIDC-capable services, this is considerably nicer than maintaining separate passwords.
Passkey-only is both the appeal and the limit
Pocket ID works best when the operator wants to commit to passkeys. A user stores one in a browser, phone, password manager, or security key and unlocks it with the device's own protection. Admins cannot create passkeys for other users, which preserves the security boundary but makes enrollment an operational process. They create a short-lived login code, send it through a trusted channel, and the user registers a credential. Signup tokens can support controlled self-enrollment.
Recovery deserves a written procedure before the first client is connected. An administrator can issue another code from the web interface or command line. Users with an enrolled passkey on another device can approve a QR flow. Email one-time access is optional, but the documentation plainly calls it insecure because control of the mailbox becomes control of the Pocket ID account. If that compromise is unacceptable, disable email login and enroll more than one passkey for administrators. Store a hardware key somewhere safe.
This model will not suit every organization. Users who cannot use WebAuthn, policies that mandate passwords plus a separate second factor, and workflows built around social identity need another product. Pocket ID's simplicity comes from declining those branches, not hiding them behind an easier interface.
Installation is short, trust is not
The recommended Compose file has one service, one environment file, port 1411, and a persistent /app/data mount. Set APP_URL, generate an encryption key, start the container, and create the initial administrator under /setup. A standalone binary is also available. The application itself can be running quickly.
WebAuthn requires a secure browser context, so a real deployment needs HTTPS and a stable hostname. Changing that site later can strand credentials because passkeys are scoped to the relying party. Reverse-proxy trust must be configured narrowly enough that clients cannot forge their address. The environment reference also defaults to allowing insecure callback URLs on non-loopback hosts and recommends setting that option to false unless a client truly needs HTTP. Review the defaults instead of copying the example untouched.
Security-conscious operators get useful choices. A distroless image runs non-root, and the container can use a read-only root filesystem once mount ownership is correct. The normal image starts as root only to prepare permissions, then drops privileges. Offline installations can disable version checks and the daily analytics heartbeat. By default, that heartbeat sends a random instance identifier, version, and timestamps; it can be turned off.
Backups require more caution. The CLI can export and import a ZIP across installations or database providers, but its own guide labels the feature experimental and warns that import erases existing database and upload data. Keep filesystem or database-level backups as the primary safety net, preserve the encryption key, and rehearse recovery on a separate hostname or isolated network.
Directory features without enterprise scale
LDAP sync runs at startup and hourly, bringing users and groups from systems such as OpenLDAP, Active Directory, or LLDAP. Synced records cannot be edited in Pocket ID, which correctly leaves the directory authoritative. An LDAP-first setup needs at least one member in the designated admin group before sync. SCIM works in the other direction, pushing Pocket ID users and groups to supporting client applications on a schedule or after changes.
These features cover a surprisingly useful middle ground, but horizontal scale remains unfinished. The current HA tracking issue still lists coordination for signing keys, LDAP and SCIM jobs, shared filesystem state, WebAuthn and OAuth session expiry, and other cluster-wide tasks. Several foundational items are complete, yet the checklist explicitly retains an HA_ENABLED task. Run one replica unless the project documents otherwise. Keycloak or Authentik is the safer buy when multiple active instances are a hard requirement.
Recent reports also deserve attention because this service sits on every application's front door. One SQLite deployment reports repeated database locks and process exits. A separate v2.12 report says the API rate limiter stayed unavailable and allowed requests through while health checks remained green. After v2.13.0, one PostgreSQL Kubernetes user reported that the application-configuration page stopped loading. These are reports in particular environments, not proof that every instance fails, but they justify monitoring real login and admin flows rather than only /healthz.
Fast development, with the risk that brings
Version 2.13.0 shipped August 7, 2026, and included OAuth token compliance, client session-duration controls, passkey restrictions, and many security and reliability fixes. The repository was pushed again on August 8, while issues and pull requests were active that day. GitHub's open count of 94 combines both types of work. The pace and outside contributions are strong, though the new regression report shows why an identity provider should be upgraded first in a staging copy.
Pocket ID is an excellent fit for a single-node home lab or smaller team committed to passkeys. It earns that recommendation by staying opinionated while still supplying the groups, provisioning, audit, and client guidance needed in real use. Back up the key and data, monitor authentication itself, keep emergency credentials, and wait for the HA checklist if losing one instance is unacceptable.