Pocket ID

A simple OIDC provider that authenticates users via passkeys.

Decommissioned

Pocket ID was removed from the Talos cluster in August 2026 and no longer serves any client. It is a genuinely nice project — small, passkey-only, almost no operational weight — and a very good fit for a homelab that wants passwordless SSO without running a full IAM suite. It was retired here because the cluster had ended up with two OIDC providers, and a single, professional-grade IdP with LDAP federation, SAML, and realm-level policy won that consolidation: every former Pocket ID client now authenticates against Keycloak. See Identity end-to-end for the current picture. Nothing of it remains under k8s/: the Talos overlay and Flux entry went with the decommissioning, and the base manifests were deleted on 2026-08-28.

Pocket ID is a lightweight, self-hosted OIDC identity provider that uses passkeys (WebAuthn) as the sole authentication method — no passwords. It provides OIDC/OAuth2 endpoints for applications to integrate SSO. Self-hosting means full control over your identity provider without paying for Auth0, Okta, or similar cloud services.

Alternatives considered

Cloud Hosted

Tool	Open Source	Free Tier	Monthly Cost
Auth0	No	Limited	From $35/mo

Self Hosted

Tool	Open Source	Full Features	Notes
Keycloak	Yes	Yes	Full IAM suite; much heavier — and, since August 2026, the provider that replaced Pocket ID here
Authentik	Yes	Yes	Modern IdP with more auth methods

Installation

Architecture

• Deployment: Single pocketid deployment in the pocketid namespace
• Image: ghcr.io/pocket-id/pocket-id:v2.14.0 (digest-pinned; last version deployed)
• Database: CNPG PostgreSQL cluster with Longhorn-encrypted PVCs
• Storage: Longhorn PVC (pocketid-data) for app files
• Networking: ClusterIP service on port 80, HTTPRoute via public gateway

Security

• Runs as runAsUser: 0, runAsNonRoot: false
• Longhorn PVC and CNPG PVCs encrypted at rest via SOPS-managed keys

Updates

Was managed by Renovate with a digest-pinned image until the app was removed.

Data Management

• Database: CNPG PostgreSQL cluster (Longhorn-encrypted PVCs)
• PVC: pocketid-data (Longhorn-encrypted) for passkey registrations and app files
• Backups: the database was dumped and backed up by k8up via restic until the app was removed.

User Management

Pocket ID was an OIDC provider, not a consumer. At its peak it held seventeen registered clients — Accounting, Gatus, Gitea, Grafana, Immich, Nextcloud, Outline, RomM, Vikunja, and others — all of which were re-registered in Keycloak during the August 2026 migration. Users registered passkeys via the web UI.

Configuration Management

• SMTP credentials for email notifications from SOPS-encrypted secret (allinkl-smtp-credentials)
• Database connection string injected from CNPG-generated secret
• ANALYTICS_DISABLED and other app settings from env vars

Usage

Register passkeys via the web UI for passwordless authentication. Add OIDC clients for applications that need SSO. Users authenticate by scanning a QR code or using a device passkey. Email notifications for account events are sent via the configured SMTP server.

No cluster deploys Pocket ID any more. Its former Talos overlay (HTTPRoute, CNPG cluster, k8up schedule, network policies) was removed in August 2026, and the base manifests followed on 2026-08-28 — k8s/apps/pocketid/ no longer exists.