Pocket ID

Overview

Pocket ID is a small, single sign-on server for the apps you run yourself. You sign in once with a passkey, your fingerprint, face, or a hardware key, and every app connected to it lets you straight in. It speaks OpenID Connect, the same standard used by "Sign in with Google" buttons, so most self-hosted apps can talk to it out of the box.

Features

• Passkey sign-in, so there is no password to guess, reuse, or leak
• One account for every connected app, and one place to remove access
• Accounts and groups for the whole household, with an admin view
• A login code the admin can hand out when someone gets a new device
• An audit log of every sign in, with the device and the address it came from
• Works with any app that supports OpenID Connect or OAuth 2.0

Setting up

The first account you create when you open the app becomes the administrator, and you set up your passkey during that first screen.

Two things to do before you connect other apps:

• Open this app's access setting and switch it to Public. Other apps and other people in your household need to reach the sign-in page, and it starts out open only to you.
• Add each app you want to connect under OIDC Clients. Pocket ID gives you a client ID and a secret to paste into that app's own settings.

You can also set up a mail account under Settings if you want Pocket ID to email login codes. That is optional, and it is your own mail account, not one we provide.

Good to know

Sign-in needs a passkey, so keep more than one. Add a second passkey, or a second administrator, as soon as you finish setting up. If you are the only administrator and you lose your passkey, there is no way back in from the app or from this box.

Everything stays on your box. Pocket ID never sends your accounts, keys, or sign-in history anywhere, and the usage reporting the project ships with is turned off here.