How stonith404/pocket-id works
Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 provider whose user sign-in is passkey-only. Users authenticate and manage their accounts in the web app; relying applications use the OIDC endpoints to request authorization and receive tokens and user claims. Administrators configure clients, users, groups, and application settings. The tree also shows user provisioning integrations and file storage. The sampled code supports the client-management and authorization links; broader subsystem links reflect documented product purpose and module boundaries, not inspected internal call paths.
Main entry points: database.go Application database · provider.go OIDC provider · user_controller.go User API · user_service.go User management
Components 20
Web experience
- Pocket ID web app
frontend/src - Authorized app card
frontend/src/routes/settings/apps/authorized-oidc-client-card.svelte - Client preview
frontend/src/routes/settings/admin/oidc-clients/oidc-client-preview-modal.svelte
Identity and OIDC
- OIDC provider
backend/internal/oidc/provider.go - Authorization flow
backend/internal/oidc/authorization_service.go - Passkey authentication
backend/internal/webauthn/service.go - Email verification
backend/internal/emailverification/service.go
Administration
- OIDC API
backend/internal/controller/oidc_controller.go - User API
backend/internal/controller/user_controller.go - OIDC management
backend/internal/service/oidc_service.go - User management
backend/internal/service/user_service.go - SCIM provisioning
backend/internal/scimsync/service.go - LDAP synchronization
backend/internal/ldapsync/service.go
Platform services
- HTTP API
backend/internal/httpserver/handler.go - Route setup
backend/internal/bootstrap/router_bootstrap.go - Application database
backend/internal/storage/database.go - File storage
backend/internal/storage/storage.go
Other components
- User
- Relying application
- Client JWKS
Connections 22
- User → Pocket ID web app: uses
- Pocket ID web app → HTTP API: sends API requests
- HTTP API → Route setup: dispatches routes
- Route setup → OIDC API: routes OIDC API
- Route setup → User API: routes user API
- OIDC API → OIDC management: calls
- User API → User management: calls
- OIDC management → Application database: reads and writes
- User management → Application database: reads and writes
- User API → Passkey authentication: manages credentials
- OIDC provider → Authorization flow: authorizes requests
- Relying application → OIDC provider: requests authorization
- OIDC provider → Relying application: issues tokens
- Authorization flow → Application database: persists authorization
- Client preview → OIDC API: requests preview
- Client preview → User API: loads users
- User → Authorized app card: views authorized apps
- SCIM provisioning → Application database: synchronizes identities
- LDAP synchronization → Application database: synchronizes identities
- Email verification → Application database: stores verification state
- OIDC provider → Client JWKS: fetches signing keys
- User management → File storage: stores profile images