Alternatives to Pocket ID

Small OpenID Connect provider that signs users in with passkeys only. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Pocket ID.

  • authentik

    Self-hosted identity provider for single sign-on and application access control.

    FreeOpen sourceLinuxSelf-hostedWeb

    authentik is an MIT-licensed identity provider covering SAML, OAuth2/OIDC, LDAP and RADIUS with a flow builder, far more capable but more complex than passkey-only Pocket ID.

  • Keycloak

    A self-hosted identity and access management server that adds single sign-on and login to applications.

    FreeOpen sourceSelf-hosted

    Keycloak adds OpenID Connect and SAML brokering plus LDAP and Active Directory connections, at the cost of real administrative setup effort.

  • Zitadel

    An open-source identity and access management platform with SSO, MFA and a hosted login page.

    FreemiumOpen sourceWebSelf-hosted

    Zitadel offers SSO with MFA, passwordless and social login, multi-tenancy and SDKs, aimed at developers integrating identity into applications.

  • Authelia

    Self-hosted single sign-on and two-factor portal for reverse proxies.

    FreeOpen sourceLinuxWebSelf-hosted

    Authelia is a self-hosted SSO and two-factor portal in front of a reverse proxy, with passwords and fine-grained access rules configured in YAML.

  • Casdoor

    A self-hosted identity and access management server with single sign-on, MFA and a web interface.

    FreeOpen sourceWebSelf-hosted

    Casdoor supports OAuth, OIDC, SAML, CAS, LDAP and SCIM with several MFA options and a web UI, though its wide feature scope adds complexity.

Similar software

Related functionality, not a direct replacement.