Adds a matrix entry that starts a SQLite-backed Francis runtime next to Pocket ID and points FRANCIS_HOST at it, so the same Playwright suite runs with the actor state, alarms, and placement owned by the runtime instead of embedded in Pocket ID. The suite needs no changes to work in that topology: the E2E reset seeds every actor through actors.Service() and deliberately leaves the actor store alone, so it behaves the same whichever side owns it. The CLI spec is the exception, since export and import are the two commands whose behaviour genuinely differs. It now picks the right Compose file, expects an export to carry no francis.bin, feeds the import an archive without one, and gains a case asserting that an archive that does carry one is refused. The runtime is reached over the Compose network on its UDP port, so nothing is published to the host, and the cluster CA is left unpinned, which exercises the same trust-on-first-use path an operator gets without FRANCIS_CA. Pinning is covered by a unit test instead.
Pocket ID is an easy-to-use OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.
→ Try out the Demo
The goal of Pocket ID is to be a simple and easy-to-use. There are other self-hosted OIDC and OAuth 2.0 providers like Keycloak or ORY Hydra but they are often too complex for simple use cases.
Additionally, what makes Pocket ID special is that it only supports passkey authentication, which means you don’t need a password. Some people might not like this idea at first, but I believe passkeys are the future, and once you try them, you’ll love them. For example, you can now use a physical Yubikey to sign in to all your self-hosted services easily and securely.
Setup
Pocket ID can be set up in multiple ways. The easiest and recommended way is to use Docker.
Visit the documentation for the setup guide and more information.
Contribute
You're very welcome to contribute to Pocket ID! Please follow the contribution guide to get started.