Open Support Ticket
24/7 customer support
Open Support Ticket Chat with our AVAHOST expert
English Flag English
Login
info@ava-host.com
Sign Up Login

Pocket ID Hosting

Sign in to your applications with passkeys through a simple OIDC identity provider.

Order now No setup fees
  • One click deploy
  • 1 GB RAM Memory needed
  • 15 GB Disk Space Needed
  • From 2 € Price

Official links

Pocket ID’s official links and original website

Related apps

See All

Tech

Docker image
ghcr.io/pocket-id/pocket-id:latest
Default port
1411

How Pocket ID works

Pocket ID acts as an OpenID Connect and OAuth 2.0 provider. Administrators create users, groups, and OIDC clients, then register callback URLs and issue client credentials for compatible applications. Users authenticate with passkeys rather than a Pocket ID password, and group assignments can decide which people are permitted to sign in to each connected client.

The service can also issue access tokens for protected APIs using scopes and resource indicators. Passkey requests may be approved on the current device or, where supported, from another device through a QR-based flow. The catalogue generates the encryption key, sets the public application URL, persists data in /app/data, and presents a one-time first-administrator setup on initial access.

Key Pocket ID features

Pocket ID is exclusively an identity provider; it does not include a reverse-proxy authentication layer. An application must support OIDC directly, or an independently configured proxy or middleware must translate the authentication flow. Each client requires exact redirect addresses, appropriate secrets, allowed groups, and a review of claims and scopes.

Identity infrastructure concentrates sensitive information and can lock users out when recovery is poorly planned. Administrators should enrol more than one suitable passkey where policy permits, protect the first setup link, document account-recovery procedures, limit client secrets, and test a recovery path. Application email is disabled on the hosted platform, so email-dependent recovery or invitation assumptions are inappropriate.

Pocket ID vs Auth0

Pocket ID focuses on self-hosted, passwordless OIDC and OAuth 2.0 for a relatively contained set of users and applications. Auth0 is a provider-managed customer and workforce identity platform covering OIDC, OAuth, SAML, passwordless and social login, enterprise connections, APIs, SDKs, adaptive authentication, machine identities, and tiered commercial services.

Auth0 may suit products that need managed scale, broad protocol and connection support, compliance programmes, vendor support, and ready-made development libraries. Pocket ID is attractive when passkeys and OIDC are sufficient and identity records should remain on the operator’s server. It does not reproduce Auth0’s social connections, SAML estate, adaptive controls, or support organisation.

Who uses Pocket ID

Home-lab administrators can give several compatible applications one passkey sign-in, small teams can assign access through groups, and developers can protect an internal API with scoped tokens. It can also serve as the identity source for an independently operated OIDC-aware proxy.

Pocket ID is not Active Directory, a complete LDAP service, a built-in proxy, a password vault, or a substitute for an enterprise identity programme. Operators own client registration, recovery, key protection, passkey policy, user lifecycle, audit expectations, and the security impact of every connected application.

Self-hosting Pocket ID: requirements and cost

Pocket ID resource use depends on user count, OIDC clients, sign-in frequency, token issuance, group evaluation, API activity, and stored identity data. PostgreSQL and MariaDB are Not required by the catalogue template; the persistent /app/data path stores application state. The software has no separate application charge, and correctness of client and recovery configuration matters more than raw storage for a small directory.

On AvaHost, Pocket ID uses Plan 1 at €2. The hosted Pocket ID package includes one-click deployment, a custom domain with automated HTTPS, automatic application updates, and scheduled backups. Complete the one-time administrator setup before sharing the address. The package does not configure OIDC clients, connected applications, reverse-proxy middleware, passkeys, recovery devices, social or enterprise connections, application email, or identity governance. Protect the generated encryption key and test login and recovery for every client before relying on it.

F.A.Q

  • Pocket ID starts at €2 on Plan 1. A small identity directory with a modest number of clients and sign-ins should fit that starting point. User count, authentication frequency, token requests, group checks, client registrations, and API activity are the practical signals for reviewing capacity.

  • Open the deployment and complete the one-time administrator setup before giving anyone else the URL. Then enrol appropriate passkeys, document recovery, and create OIDC clients with exact callback addresses. The hosted service does not use application email for invitations or recovery, so plan access without relying on mail delivery.

  • Pocket ID is an OIDC provider and does not include a built-in authentication proxy. Applications must support OIDC, or you must operate compatible middleware separately and register it as a client. AvaHost does not configure that proxy, create client secrets, select scopes, or verify the security of the protected application.

  • A custom domain can be connected with automated HTTPS after DNS is configured. Register every client and callback against the final address, then test discovery metadata, sign-in, logout, group access, token validation, and recovery. Changing an identity-provider hostname later can require updates across every relying application.