Pocket ID Passwordless OIDC Provider | cloudimg Support

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Pocket ID is a simple, self-hosted OpenID Connect (OIDC) provider that authenticates your users with passkeys instead of passwords. Point your existing applications at it as their identity provider and everyone signs in with the fingerprint reader, face unlock, or hardware security key they already carry.

Deploying Pocket ID yourself means installing the binary, creating a service account, writing systemd units, hardening an nginx reverse proxy, generating per-host secrets, and closing the initial-setup window before an attacker finds it. This AMI eliminates that effort entirely: a hardened, tested single sign-on service is running within minutes of launch, backed by 24/7 expert support with a one-hour average response for critical issues.

A 10-person engineering team runs Grafana, Gitea, and Portainer on AWS. Rather than manage separate credentials for each, they point all three at Pocket ID as their OIDC provider, and every developer signs in once with a fingerprint. One identity plane, zero passwords to rotate.

Pocket ID ships as a single self-contained binary that embeds its own web interface and stores everything in an embedded database, so the entire identity plane is one process run by an unprivileged service account. It listens on the loopback address and an nginx reverse proxy fronts it on port 80, serving an unauthenticated health endpoint for load-balancer probes and proxying everything else to the application. A systemd service starts it on boot and restarts it on failure.

This image IS your identity plane, so it ships with no known credential of any kind:

• No admin account, no passkey, and no secret are baked into the image
• The sole admin is created for each instance on its first boot, which closes the initial-setup route before the instance is publicly reachable - so no one can claim your identity provider
• The admin has no password and no passkey: the only way in is a single-use, one-hour sign-in link generated on that instance and stored in a root-only file
• A fresh sign-in link is minted over SSH at any time, so your SSH key is the root of trust
• A unique encryption key is generated for every instance and stored with strict permissions
• The application is bound to loopback and reached only through the nginx proxy, so the OIDC service is never exposed directly

These controls mean the AMI has a zero-credential attack surface at launch - unlike images that ship default admin accounts or static API keys that must be rotated post-deployment.

• vs. manual Pocket ID deployment: eliminates hours of systemd unit authoring, nginx configuration, secret generation, and the race to close the open admin-setup window.
• vs. full identity suites such as Keycloak or Authentik: one binary, one process, no Java runtime, no external database - dramatically fewer moving parts to secure and maintain.
• vs. managed SaaS providers such as Auth0 or Okta: your identity data stays in your own VPC. No vendor lock-in, no per-user fees at scale, full control over your authentication plane.

Passkeys use WebAuthn, which requires a secure context (HTTPS) and a registrable domain name as the relying party identifier, so a passkey can never be registered against a bare IP address. The instance boots fully working on its public IP for the one-time-link admin sign-in and all configuration; a single bundled command points it at your own domain, after which you add TLS and register passkeys. The user guide walks through this exact path.

• Manual binary installation, service-account creation, and systemd unit authoring
• Generating and securely storing per-host secrets and encryption keys
• Closing the open initial-admin setup window before an attacker reaches it
• Ongoing maintenance and security patching without expert guidance

24/7 technical support by email and chat with a one-hour average response for critical issues. Our engineers help with deployment, pointing Pocket ID at your own domain, TLS termination, connecting OIDC client applications, passkey enrolment, backups, and upgrades.

• Passwordless single sign-on across self-hosted applications for small engineering teams
• A lightweight, self-hosted alternative to a full identity suite when you need OIDC without the complexity of Keycloak
• Centralised OIDC authentication you fully own, in your own VPC, for compliance-sensitive workloads

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.