Remove the Authentik comparisons from Pocket ID and TinyAuth

2026-09-02 18:16:30 +02:00
parent b864251f48
commit 59f9d5dbc7
2 changed files with 140 additions and 38 deletions
@@ -1,21 +1,12 @@
 ---
 title: Pocket ID
-description: Install Pocket ID, a lightweight self-hosted OIDC provider using passkeys, as a minimal alternative to Authentik for single sign-on.
+description: Install Pocket ID, a lightweight self-hosted OIDC provider that lets you log in to your other apps with a passkey instead of a password.
 ---


 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
-# Pocket ID

-::note
-🎯 __Objectives:__
-
- Install Pocket ID
- Create your admin account and first passkey
- Register an OIDC client for another app
-::
-
-[Pocket ID](https://pocket-id.org) is a minimalist, self-hosted OIDC (OpenID Connect) provider. Unlike [Authentik](/serveex/advanced/authentik), it doesn't try to do everything: no LDAP, no proxy outposts, no complex flow builder. It only does one thing: let you log in to OIDC-compatible apps with a **passkey** (fingerprint, face unlock, or security key) instead of a password.
+[Pocket ID](https://pocket-id.org) is a minimalist, self-hosted OIDC (OpenID Connect) provider built entirely around passkeys: instead of managing passwords, you and your users log in to compatible apps with a **passkey** (fingerprint, face unlock, or a hardware security key). It runs as a single lightweight container with no external database to manage, and it does exactly one thing well: issuing OIDC logins.

 This makes it a good fit if you just need a simple, fast SSO backend, for example to pair with [TinyAuth](/serveex/security/tinyauth) as a lightweight forward-auth setup, or to log in directly to apps that natively support OIDC.

@@ -33,18 +24,23 @@ root
        └── data
 ```

-Create the data folder:
+::steps{level="3"}
+### Create the data folder

 ```bash [Terminal]
 sudo mkdir -p /docker/pocket-id/data
 ```

-Generate an encryption key for the `.env` file:
+### Generate an encryption key

 ```bash [Terminal]
 openssl rand -base64 32
 ```

+Keep the output, you'll need it for the `.env` file below.
+
+### Deploy the stack
+
 Open Dockge, click `compose`, name the stack `pocket-id`, and add the following config:

 ```yaml [compose.yaml]
@@ -55,7 +51,6 @@ services:
    container_name: pocket-id
    restart: unless-stopped
    env_file:
-
      - .env
    volumes:

@@ -83,6 +78,8 @@ services:
 ```
 ::

+### Set your environment variables
+
 Fill in the `.env` file:

 ```properties [.env]
@@ -99,6 +96,9 @@ TRUST_PROXY=true

 Deploy the stack. The local interface is available at `http://yourserverip:1411`.

+### Done !
+::
+
 ## First login
 Pocket ID doesn't use passwords: your first account is created with a **passkey**, which your browser or OS will generate for you (Windows Hello, Touch ID, a phone, or a hardware key like a YubiKey).

@@ -118,6 +118,9 @@ Other apps need to reach Pocket ID over HTTPS to complete the OIDC login flow, s
 We assume you have the subdomain `id.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you use Cloudflare Zero Trust](/serveex/security/cloudflare), your box's port `443` must be forwarded to your server's port `443` in [NAT rules](/general/networking/nat).
 ::

+::steps{level="3"}
+### Add Pocket ID's network to SWAG
+
 Go to Dockge and edit SWAG's compose file by adding Pocket ID's network:

 ```yaml [compose.yaml]
@@ -144,6 +147,8 @@ Redeploy the stack and wait for SWAG to be fully operational.
 Here we assume the Pocket ID network name is `pocket-id_default`. You can check the connection by visiting SWAG's dashboard at `http://yourserverip:81`.
 ::

+### Create the subdomain.conf file
+
 In the Swag folders, create the file `id.subdomain.conf`:

 ::tip{icon=""}
@@ -182,11 +187,13 @@ server {

 ::caution

-Don't put Pocket ID behind another authentication layer (Authentik, TinyAuth, HTTP auth...). It's the identity provider itself, so locking it away would prevent anyone, including you, from logging in.
+Don't put Pocket ID behind another authentication layer (TinyAuth, HTTP auth...). It's the identity provider itself, so locking it away would prevent anyone, including you, from logging in.
 ::

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

+### Visit your new subdomain
+
 Wait a few minutes, then open `https://id.mydomain.com` in your browser.

 ::caution
@@ -194,14 +201,26 @@ Wait a few minutes, then open `https://id.mydomain.com` in your browser.
 __If it fails:__ check your firewall rules.
 ::

+### Done !
+::
+
 ## Registering an OIDC client
 To let another app (e.g. [TinyAuth](/serveex/security/tinyauth)) log in through Pocket ID, you need to register it as an OIDC client:

- Go to `https://id.mydomain.com`
- Log in with your passkey
- Go to _Administration > OIDC Clients_
- Click _Add OIDC Client_
- Fill in a name (e.g. `TinyAuth`) and the app's callback URL (provided by the app you're protecting)
- Save, then copy the generated __Client ID__ and __Client Secret__. You'll need them in the other app's configuration
+::steps{level="3"}
+### Log in to Pocket ID

-And that's it! Pocket ID is ready to act as your OIDC provider. Head to the [TinyAuth guide](/serveex/security/tinyauth) to use it as a forward-auth login page for the rest of your apps.
+Go to `https://id.mydomain.com` and log in with your passkey.
+
+### Create the OIDC client
+
+Go to _Administration > OIDC Clients_, then click _Add OIDC Client_. Fill in a name (e.g. `TinyAuth`) and the app's callback URL (provided by the app you're protecting).
+
+### Save your client credentials
+
+Save, then copy the generated __Client ID__ and __Client Secret__. You'll need them in the other app's configuration.
+
+### Done !
+::
+
+Pocket ID is ready to act as your OIDC provider. Head to the [TinyAuth guide](/serveex/security/tinyauth) to use it as a forward-auth login page for the rest of your apps.