Pocket ID

Why deploy Pocket ID on Render?

Pocket ID is a self-hosted OpenID Connect (OIDC) provider that authenticates users with passkeys instead of passwords. It enables single sign-on across self-hosted applications by acting as a central identity provider, bundling the OIDC server, admin UI, and passkey authentication into a single Go binary.

Deploy Pocket ID on Render and skip the entire bootstrap: this Blueprint wires the official Pocket ID image to a managed Postgres 16 instance, auto-generates your ENCRYPTION_KEY, configures FILE_BACKEND=database so uploads live alongside your users and passkeys, and attaches a persistent disk at /app/data with the single-instance deploy behavior Pocket ID needs for clean restarts—there's literally nothing to fill in. Doing this by hand means provisioning Postgres, managing secrets, setting health checks (/healthz), and getting the stop-before-start deploy sequencing right; here it's one click, and upgrades are a one-line tag bump in render.yaml plus a push. Render handles the managed database, internal-only networking, and persistent storage so you go from zero to a working OIDC provider at /setup in minutes.

Architecture

What you can build

You'll have a running OpenID Connect provider with its own admin UI and a Postgres database to back it, reachable at a public URL. From there you create an admin account secured with a passkey, then register your self-hosted apps as OIDC clients so users can sign in to them with passkeys instead of passwords. It's a single-tenant identity service you control, ready to issue tokens to any app that speaks OIDC.

Key features

• Passkey OIDC Provider: Runs the official Pocket ID image as an OpenID Connect provider with passkey-based passwordless sign-in for your self-hosted apps.
• Zero-config secrets: Render auto-generates ENCRYPTION_KEY and wires APP_URL and DB_CONNECTION_STRING on first Blueprint apply, so there is nothing to fill in.
• Postgres-backed storage: Uses FILE_BACKEND=database to store users, passkeys, OIDC clients, and uploaded images in Postgres 16 so database backups cover everything.
• Pinned image upgrades: The service pulls a pinned Docker Hub tag (pocketid/pocket-id:v2.19.2); upgrading is done by changing the tag in render.yaml and pushing.
• Single-instance deploys: A persistent disk at /app/data makes Render stop the old instance before starting the new one, which Pocket ID requires. Expect about a minute of downtime per deploy.

Use cases

• Homelab owner adds passwordless passkey sign-in across self-hosted apps
• Startup founder centralizes employee logins with one OIDC provider
• Sysadmin migrates existing Pocket ID instance to Render with Postgres
• Developer secures internal dashboards with passkeys instead of shared passwords

What's included

Next steps

1. Open https://<pocket-id>.onrender.com/setup immediately and create the admin account with a passkey — You should be prompted to register a passkey, and after completing it the page redirects to the admin dashboard; the open setup page is now closed so no one else can claim it
2. Add an OIDC client in the admin UI for one of your apps and copy its client ID and secret, then complete a sign-in flow from that app — You should be redirected to Pocket ID, authenticate with your passkey, and land back in your app signed in
3. If you plan to use a custom domain, add it under Settings → Custom Domains and update APP_URL to match before registering real passkeys, then run curl -fsS https://<your-domain>/healthz — The health check returns 200 and passkeys registered afterward stay bound to your permanent domain

Resources

• Pocket ID official site