Pocket ID

https://pocket-id.org/docs
Admin
Pocket ID is a lightweight, passwordless OpenID Connect (OIDC) and OAuth 2.0 provider that allows...
Tokens:61,651
Snippets:780
Trust Score:6.5
Update:1 month ago
Show doc for...
Tokens:
Raw
### Start Frontend in Development

Source: https://pocket-id.org/docs/helping-out/contributing

Commands to install dependencies and start the SvelteKit frontend.

```bash
pnpm install
pnpm dev
```

--------------------------------

### Start Backend in Development

Source: https://pocket-id.org/docs/helping-out/contributing

Command to start the Go-based backend with frontend exclusion tags.

```bash
go run -tags exclude_frontend ./cmd
```

--------------------------------

### Install Passport Strategy

Source: https://pocket-id.org/docs/client-examples/node-red

Install the required passport-openidconnect package via npm.

```bash
npm install passport-openidconnect
```

--------------------------------

### Start Caddy

Source: https://pocket-id.org/docs/guides/proxy-services

Command to start the Caddy server using the specified configuration file.

```bash
caddy run --config Caddyfile
```

--------------------------------

### Access Admin Setup URL

Source: https://pocket-id.org/docs/troubleshooting/common-issues

Navigate to the setup endpoint to initialize the admin user's passkey.

```text
https://id.example.com/setup
```

--------------------------------

### GET /api/signup-tokens

Source: https://pocket-id.org/docs/api

Get a paginated list of signup tokens.

```APIDOC
## GET /api/signup-tokens

### Description
Get a paginated list of signup tokens.

### Method
GET

### Endpoint
/api/signup-tokens

### Parameters
#### Query Parameters
- **pagination[page]** (integer) - Optional
- **pagination[limit]** (integer) - Optional
- **sort[column]** (string) - Optional
- **sort[direction]** (string) - Optional

### Response
#### Success Response (200)
- **data** (array<usersignup.signupTokenDto>)
- **pagination** (dto.Pagination)
```

--------------------------------

### Backup Existing Installation

Source: https://pocket-id.org/docs/setup/major-releases/migrate-v1

Create a copy of the current installation directory before performing the upgrade.

```bash
   cp -r /path/to/pocket-id /path/to/pocket-id-old 
```

--------------------------------

### Setup kubelogin

Source: https://pocket-id.org/docs/client-examples/talos

Initialize the kubelogin configuration and validate the OIDC token.

```bash
kubectl oidc-login setup --oidc-issuer-url=<pocket ID url> --oidc-client-id=<client ID> --oidc-client-secret=<client secret> --oidc-extra-scope=groups,email,name,sub,email_verified
```

--------------------------------

### Download Environment File for Standalone

Source: https://pocket-id.org/docs/setup/installation

Retrieves the example environment configuration file.

```bash
curl -o .env https://raw.githubusercontent.com/pocket-id/pocket-id/main/.env.example
```

--------------------------------

### Install caddy-security

Source: https://pocket-id.org/docs/guides/proxy-services

Command to add the caddy-security package to your Caddy installation.

```bash
caddy add-package github.com/greenpau/caddy-security
```

--------------------------------

### POST /api/signup/setup

Source: https://pocket-id.org/docs/api

Sign up and generate setup access token for initial admin user.

```APIDOC
## POST /api/signup/setup

### Description
Sign up and generate setup access token for initial admin user.

### Method
POST

### Endpoint
/api/signup/setup

### Request Body
- **email** (string) - Optional
- **firstName** (string) - Optional
- **lastName** (string) - Optional
- **token** (string) - Optional
- **username** (string) - Required

### Response
#### Success Response (200)
- **customClaims** (array<dto.CustomClaimDto>)
- **disabled** (boolean)
- **displayName** (string)
- **email** (string)
- **emailVerified** (boolean)
- **firstName** (string)
- **id** (string)
- **isAdmin** (boolean)
- **lastName** (string)
- **ldapId** (string)
- **locale** (string)
- **userGroups** (array<dto.UserGroupMinimalDto>)
- **username** (string)
```

--------------------------------

### Start Pocket ID

Source: https://pocket-id.org/docs/setup/upgrading

Command to launch the updated binary.

```bash
./pocket-id
```

--------------------------------

### Configure Gotify with Docker Run

Source: https://pocket-id.org/docs/client-examples/gotify

Example command for deploying Gotify with OIDC configuration via CLI.

```bash
docker run -d --name gotify --restart unless-stopped   -p 8080:80   -v gotify-data:/app/data   -e GOTIFY_OIDC_ENABLED=true   -e GOTIFY_OIDC_ISSUER=https://auth.example.org   -e GOTIFY_OIDC_CLIENTID=YOUR_CLIENT_ID   -e GOTIFY_OIDC_CLIENTSECRET=YOUR_CLIENT_SECRET   -e GOTIFY_OIDC_REDIRECTURL=https://gotify.example.org/auth/oidc/callback   -e GOTIFY_OIDC_AUTOREGISTER=true   -e GOTIFY_OIDC_USERNAMECLAIM=preferred_username   -e GOTIFY_OIDC_LINK_BY_USERNAME=false   -e GOTIFY_OIDC_SCOPES="openid,profile,email"   gotify/server
```

--------------------------------

### Actual Budget Environment Variable Configuration

Source: https://pocket-id.org/docs/client-examples/actual-budget

Example configuration using environment variables for Actual Budget.

```bash
ACTUAL_OPENID_DISCOVERY_URL=https://<pocket-id-domain.tld>
ACTUAL_OPENID_CLIENT_ID=xxxxx-xxxxx-xxxxx
ACTUAL_OPENID_CLIENT_SECRET=xxxxx-xxxxx-xxxxx
```

--------------------------------

### Configure PostgreSQL Connection String

Source: https://pocket-id.org/docs/configuration/environment-variables

The format and an example for the PostgreSQL DSN connection string.

```text
Format:
postgresql://[user[:password]@][netloc][:port][/dbname][?param1=value1&...]

Example:
postgres://pocketid:123456@localhost:5432/pocketid
```

--------------------------------

### GET /api/application-configuration/all

Source: https://pocket-id.org/docs/api

Retrieves all application configurations, including private ones.

```APIDOC
## GET /api/application-configuration/all

### Description
Get all application configurations including private ones.

### Method
GET

### Endpoint
/api/application-configuration/all

### Response
#### Success Response (200)
- **isPublic** (boolean)
- **key** (string)
- **type** (string)
- **value** (string)

#### Error Response (default)
- **code** (apperror.Code)
- **details** (map<string, object>)
- **error** (string)
- **request_id** (string)
```

--------------------------------

### Actual Budget JSON Configuration

Source: https://pocket-id.org/docs/client-examples/actual-budget

Example configuration using a config.json file for Actual Budget.

```json
"openId": {
        "discoveryURL": "URL for the OpenID Provider",
        "client_id": "client_id given by the provider",
        "client_secret": "client_secret given by the provider",
        "server_hostname": "your Actual Server URL (so the provider redirects you to this)",
        "authMethod": "openid" // or "oauth2"
    }
```

--------------------------------

### Define Instance URLs

Source: https://pocket-id.org/docs/client-examples/vikunja

Example variables for Vikunja and Pocket ID instance URLs.

```text
vikunja.example.com (The URL of your Vikunja instance.)
id.example.com (The URL of your Pocket ID instance.)
```

--------------------------------

### Configure Gotify with Docker Compose

Source: https://pocket-id.org/docs/client-examples/gotify

Example service configuration for Gotify using Docker Compose.

```yaml
services:
  gotify:
    container_name: gotify
    restart: unless-stopped
    image: gotify/server
    ports:
      - 8080:80
    volumes:
      - gotify-data:/app/data
    environment:
      - GOTIFY_OIDC_ENABLED=true
      - GOTIFY_OIDC_ISSUER=https://auth.example.org
      - GOTIFY_OIDC_CLIENTID=YOUR_CLIENT_ID
      - GOTIFY_OIDC_CLIENTSECRET=YOUR_CLIENT_SECRET
      - GOTIFY_OIDC_REDIRECTURL=https://gotify.example.org/auth/oidc/callback
      - GOTIFY_OIDC_AUTOREGISTER=true
      - GOTIFY_OIDC_USERNAMECLAIM=preferred_username
      - GOTIFY_OIDC_LINK_BY_USERNAME=false
      - GOTIFY_OIDC_SCOPES=openid,profile,email
```

--------------------------------

### Download latest binary

Source: https://pocket-id.org/docs/setup/upgrading

Example command to download the Linux AMD64 binary using curl.

```bash
curl -L -o pocket-id_linux_amd64 https://github.com/pocket-id/pocket-id/releases/latest/download/pocket-id_linux_amd64
```

--------------------------------

### Install Pocket ID via Homebrew

Source: https://pocket-id.org/docs/setup/installation

Use the Homebrew package manager to install Pocket ID on macOS or Linux.

```bash
brew install pocket-id
```

--------------------------------

### GET /api/application-configuration

Source: https://pocket-id.org/docs/api

Retrieves all public application configurations.

```APIDOC
## GET /api/application-configuration

### Description
Get all public application configurations.

### Method
GET

### Endpoint
/api/application-configuration

### Response
#### Success Response (200)
- **key** (string)
- **type** (string)
- **value** (string)

#### Error Response (default)
- **code** (apperror.Code)
- **details** (map<string, object>)
- **error** (string)
- **request_id** (string)
```

--------------------------------

### Conventional Commit Example

Source: https://pocket-id.org/docs/helping-out/contributing

Example of a commit message following the Conventional Commits specification.

```text
fix: hide global audit log switch for non admin users
```

--------------------------------

### Globstar Wildcard Examples

Source: https://pocket-id.org/docs/advanced/callback-url-wildcards

Demonstrates usage of the globstar (**) to match across multiple path segments.

```text
https://example.com/callback
https://example.com/oauth/callback
https://example.com/api/v1/oauth/callback
```

--------------------------------

### Configure Vikunja with Account Linking

Source: https://pocket-id.org/docs/client-examples/vikunja

Extended config.yml example enabling username and email fallback for linking existing local accounts.

```yaml
auth:
  openid:
    enabled: true
    redirecturl: https://vikunja.example.com/auth/openid/pocketid
    providers:
      PocketID:  
        name: PocketID
        usernamefallback: true
        emailfallback: true
        authurl: https://id.example.com
        clientid: <POCKET_ID_CLIENT_ID>
        clientsecret: <POCKET_ID_SECRET>
        scope: openid profile email
        forceuserinfo: false # Optional: Set to true to always use UserInfo endpoint instead of ID token claims, defaults to false
```

--------------------------------

### Single Wildcard Examples

Source: https://pocket-id.org/docs/advanced/callback-url-wildcards

Demonstrates usage of the single wildcard (*) to match characters within a single URL segment.

```text
https://*.example.com/oauth/callback
https://app.example.com:*/oauth/callback
https://user:*@example.com/oauth/callback
https://example.com/oauth/*/callback
https://example.com/oauth/callback?env=prod*&code=*
```

--------------------------------

### Migrate Data Directory

Source: https://pocket-id.org/docs/setup/major-releases/migrate-v1

Move the existing data directory to the new binary installation folder.

```bash
   cp -r /path/to/pocket-id-old/data /path/to/pocket-id/data 
```

--------------------------------

### GET /.well-known/openid-configuration

Source: https://pocket-id.org/docs/api

Returns the OpenID Connect discovery document.

```APIDOC
## GET /.well-known/openid-configuration

### Description
Returns the OpenID Connect discovery document with endpoints and capabilities.

### Method
GET

### Endpoint
/.well-known/openid-configuration
```

--------------------------------

### Install Pocket ID on Proxmox

Source: https://pocket-id.org/docs/setup/installation

Execute this command as root in the Proxmox shell to run the community-provided helper script.

```bash
bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/pocketid.sh)"
```

--------------------------------

### GET /api/oidc/userinfo

Source: https://pocket-id.org/docs/api

Get user information based on the access token.

```APIDOC
## GET /api/oidc/userinfo

### Description
Get user information based on the access token.

### Method
GET

### Endpoint
/api/oidc/userinfo

### Response
#### Success Response (200)
- **claims** (object) - User claims based on requested scopes
```

--------------------------------

### GET /api/oidc/clients/{id}

Source: https://pocket-id.org/docs/api

Get detailed information about an OIDC client.

```APIDOC
## GET /api/oidc/clients/{id}

### Description
Get detailed information about an OIDC client.

### Method
GET

### Endpoint
/api/oidc/clients/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - Client ID

### Response
#### Success Response (200)
- **id** (string) - Client ID
- **name** (string) - Client name
```

--------------------------------

### GET /api/apis

Source: https://pocket-id.org/docs/api

Get a paginated list of APIs with optional search and sorting.

```APIDOC
## GET /api/apis

### Description
Get a paginated list of APIs with optional search and sorting.

### Method
GET

### Endpoint
/api/apis

### Parameters
#### Query Parameters
- **search** (string) - Optional - Search term to filter APIs by name or resource
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)

### Response
#### Success Response (200)
- **data** (array<api.apiResponseDto>) - List of APIs
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### Content Security Policy Configuration

Source: https://pocket-id.org/docs/client-examples/oCIS

Example CSP configuration for oCIS. Ensure the connect-src directive includes your Pocket ID URL.

```yaml
directives:   child-src:     - '''self'''   connect-src:     - '''self'''     - 'blob:'     - 'https://raw.githubusercontent.com/owncloud/awesome-ocis/'     # In contrary to bash and docker the default is given after the | character     - 'https://pocket-id.company.com/'   default-src:     - '''none'''   font-src:     - '''self'''   frame-ancestors:     - '''none'''   frame-src:     - '''self'''     - 'blob:'     - 'https://embed.diagrams.net/'   img-src:     - '''self'''     - 'data:'     - 'blob:'     - 'https://raw.githubusercontent.com/owncloud/awesome-ocis/'   manifest-src:     - '''self'''   media-src:     - '''self'''   object-src:     - '''self'''     - 'blob:'   script-src:     - '''self'''     - '''unsafe-inline'''   style-src:     - '''self'''     - '''unsafe-inline''' 
```

--------------------------------

### GET /api/users

Source: https://pocket-id.org/docs/api

Get a paginated list of users with optional search and sorting.

```APIDOC
## GET /api/users

### Description
Get a paginated list of users with optional search and sorting.

### Method
GET

### Endpoint
/api/users

### Parameters
#### Query Parameters
- **search** (string) - Optional
- **pagination[page]** (integer) - Optional
- **pagination[limit]** (integer) - Optional
- **sort[column]** (string) - Optional
- **sort[direction]** (string) - Optional
```

--------------------------------

### FreshRSS Docker Compose Configuration

Source: https://pocket-id.org/docs/client-examples/freshrss

Example configuration for deploying FreshRSS with OIDC authentication enabled via environment variables.

```yaml
services:
  freshrss:
    image: freshrss/freshrss:1.25.0
    container_name: freshrss
    ports:
      - 8080:80
    volumes:
      - /freshrss_data:/var/www/FreshRSS/data
      - /freshrss_extensions:/var/www/FreshRSS/extensions
    environment:
      CRON_MIN: 1,31
      TZ: Etc/UTC
      OIDC_ENABLED: 1
      OIDC_CLIENT_ID: <POCKET_ID_CLIENT_ID>
      OIDC_CLIENT_SECRET: <POCKET_ID_SECRET>
      OIDC_PROVIDER_METADATA_URL: https://id.example.com/.well-known/openid-configuration
      OIDC_SCOPES: openid email profile
      OIDC_X_FORWARDED_HEADERS: X-Forwarded-Proto X-Forwarded-Host
      OIDC_REMOTE_USER_CLAIM: preferred_username
    restart: unless-stopped
    networks:
      - freshrss
networks:
  freshrss:
    name: freshrss
```

--------------------------------

### GET /api/oidc/users/me/clients

Source: https://pocket-id.org/docs/api

Get a list of OIDC clients that the current user can access.

```APIDOC
## GET /api/oidc/users/me/clients

### Description
Get a list of OIDC clients that the current user can access.

### Method
GET

### Endpoint
/api/oidc/users/me/clients
```

--------------------------------

### Build and Configure Pocket ID from Source

Source: https://pocket-id.org/docs/setup/installation

Clones the repository, builds the frontend and backend, and initializes the environment file. Requires Node.js, Go, and Git installed on the system.

```bash
# Clone the repo
git clone https://github.com/pocket-id/pocket-id
cd pocket-id

# Checkout latest version
git fetch --tags && git checkout $(git describe --tags `git rev-list --tags --max-count=1`)

# Build the frontend
pnpm --filter pocket-id-frontend install
pnpm --filter pocket-id-frontend build

# Build the backend
cd ../backend/cmd
go build -o ../../pocket-id

# Create the .env file
cd ../../
cp .env.example .env
```

--------------------------------

### GET /api/oidc/clients/{id}/logo

Source: https://pocket-id.org/docs/api

Get the logo image for an OIDC client.

```APIDOC
## GET /api/oidc/clients/{id}/logo

### Description
Get the logo image for an OIDC client.

### Method
GET

### Endpoint
/api/oidc/clients/{id}/logo

### Parameters
#### Path Parameters
- **id** (string) - Required - Client ID

#### Query Parameters
- **light** (boolean) - Optional - Light mode logo (true) or dark mode logo (false)
```

--------------------------------

### Prepare Binary for Execution

Source: https://pocket-id.org/docs/setup/major-releases/migrate-v1

Rename the downloaded file and grant execution permissions.

```bash
   mv pocket-id-<operating-system>-<architecture> pocket-id    chmod +x pocket-id 
```

--------------------------------

### GET /api/user-groups

Source: https://pocket-id.org/docs/api

Get a paginated list of user groups with optional search and sorting.

```APIDOC
## GET /api/user-groups

### Description
Get a paginated list of user groups with optional search and sorting.

### Method
GET

### Endpoint
/api/user-groups

### Parameters
#### Query Parameters
- **search** (string) - Optional - Search term to filter user groups by name
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)

### Response
#### Success Response (200)
- **data** (array<dto.UserGroupMinimalDto>) - List of user groups
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### GET /api/oidc/users/me/authorized-clients

Source: https://pocket-id.org/docs/api

Get a paginated list of OIDC clients that the current user has authorized.

```APIDOC
## GET /api/oidc/users/me/authorized-clients

### Description
Get a paginated list of OIDC clients that the current user has authorized.

### Method
GET

### Endpoint
/api/oidc/users/me/authorized-clients

### Parameters
#### Query Parameters
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)
- **filters[hasLaunchURL]** (boolean) - Optional - Filter clients by whether a launch URL is configured

### Response
#### Success Response (200)
- **data** (array<dto.AuthorizedOidcClientDto>) - List of authorized clients
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### GET /api/oidc/clients/{id}/meta

Source: https://pocket-id.org/docs/api

Get OIDC client metadata for discovery and configuration.

```APIDOC
## GET /api/oidc/clients/{id}/meta

### Description
Get OIDC client metadata for discovery and configuration.

### Method
GET

### Endpoint
/api/oidc/clients/{id}/meta
```

--------------------------------

### Download Docker Compose and Environment Files

Source: https://pocket-id.org/docs/setup/installation

Fetches the required configuration files for a Docker-based deployment.

```bash
curl -o docker-compose.yml https://raw.githubusercontent.com/pocket-id/pocket-id/main/docker-compose.yml
curl -o .env https://raw.githubusercontent.com/pocket-id/pocket-id/main/.env.example
```

--------------------------------

### GET /api/oidc/clients

Source: https://pocket-id.org/docs/api

Get a paginated list of OIDC clients with optional search and sorting.

```APIDOC
## GET /api/oidc/clients

### Description
Get a paginated list of OIDC clients with optional search and sorting.

### Method
GET

### Endpoint
/api/oidc/clients

### Parameters
#### Query Parameters
- **search** (string) - Optional - Search term to filter clients by name
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)

### Response
#### Success Response (200)
- **data** (array<dto.OidcClientWithAllowedGroupsDto>) - List of OIDC clients
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### GET /api/api-keys

Source: https://pocket-id.org/docs/api

Get a paginated list of API keys belonging to the current user.

```APIDOC
## GET /api/api-keys

### Description
Get a paginated list of API keys belonging to the current user.

### Method
GET

### Endpoint
/api/api-keys

### Parameters
#### Query Parameters
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)

### Response
#### Success Response (200)
- **data** (array<apikey.apiKeyDto>) - List of API keys
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### Full Distroless Docker Compose Example

Source: https://pocket-id.org/docs/advanced/hardening

A complete docker-compose.yml configuration utilizing a distroless image, non-root user, read-only filesystem, and a healthcheck.

```yaml
services:
  pocket-id:
    image: ghcr.io/pocket-id/pocket-id:v2-distroless
    restart: unless-stopped
    env_file: .env
    ports:
      - 1411:1411
    volumes:
      - './data:/app/data'
    read_only: true
    user: '1000:1000'
    # Optional healthcheck
    healthcheck:
      test: ['CMD', '/app/pocket-id', 'healthcheck']
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
```

--------------------------------

### GET /api/oidc/clients/{id}/scim-service-provider

Source: https://pocket-id.org/docs/api

Get the SCIM service provider configuration for an OIDC client.

```APIDOC
## GET /api/oidc/clients/{id}/scim-service-provider

### Description
Get the SCIM service provider configuration for an OIDC client.

### Method
GET

### Endpoint
/api/oidc/clients/{id}/scim-service-provider

### Parameters
#### Path Parameters
- **id** (string) - Required - Client ID
```

--------------------------------

### GET /api/apis/{id}/assignable-clients

Source: https://pocket-id.org/docs/api

Get a paginated list of OIDC clients that have no grant on the API yet.

```APIDOC
## GET /api/apis/{id}/assignable-clients

### Description
Get a paginated list of OIDC clients that have no grant on the API yet.

### Method
GET

### Endpoint
/api/apis/{id}/assignable-clients

### Parameters
#### Path Parameters
- **id** (string) - Required - API ID

#### Query Parameters
- **search** (string) - Optional - Search term to filter clients by name
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)
```

--------------------------------

### GET /api/api-access/{clientId}/assignable-apis

Source: https://pocket-id.org/docs/api

Get a paginated list of APIs the OIDC client cannot already reach.

```APIDOC
## GET /api/api-access/{clientId}/assignable-apis

### Description
Get a paginated list of APIs the OIDC client cannot already reach.

### Method
GET

### Endpoint
/api/api-access/{clientId}/assignable-apis

### Parameters
#### Path Parameters
- **clientId** (string) - Required - OIDC Client ID

#### Query Parameters
- **search** (string) - Optional - Search term to filter APIs by name or resource
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)

### Response
#### Success Response (200)
- **data** (array<api.apiResponseDto>) - List of assignable APIs
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### GET /api/oidc/users/{id}/authorized-clients

Source: https://pocket-id.org/docs/api

Get a paginated list of OIDC clients that a specific user has authorized.

```APIDOC
## GET /api/oidc/users/{id}/authorized-clients

### Description
Get a paginated list of OIDC clients that a specific user has authorized.

### Method
GET

### Endpoint
/api/oidc/users/{id}/authorized-clients

### Parameters
#### Path Parameters
- **id** (string) - Required - User ID

#### Query Parameters
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)
- **filters[hasLaunchURL]** (boolean) - Optional - Filter clients by whether a launch URL is configured

### Response
#### Success Response (200)
- **data** (array<dto.AuthorizedOidcClientDto>) - List of authorized clients
- **pagination** (dto.Pagination) - Pagination metadata
```

--------------------------------

### Enable LDAP via Environment Variables

Source: https://pocket-id.org/docs/configuration/ldap

Set these variables in your .env file to configure LDAP during initial setup when UI configuration is disabled.

```bash
LDAP_ENABLED=true
UI_CONFIG_DISABLED=true
```

--------------------------------

### GET /api/apis/{id}/clients

Source: https://pocket-id.org/docs/api

Get a paginated list of OIDC clients that may reach the API, with their permissions split into user-delegated and client access.

```APIDOC
## GET /api/apis/{id}/clients

### Description
Get a paginated list of OIDC clients that may reach the API, with their permissions split into user-delegated and client (machine-to-machine) access.

### Method
GET

### Endpoint
/api/apis/{id}/clients

### Parameters
#### Path Parameters
- **id** (string) - Required - API ID

#### Query Parameters
- **search** (string) - Optional - Search term to filter clients by name
- **pagination[page]** (integer) - Optional - Page number for pagination
- **pagination[limit]** (integer) - Optional - Number of items per page
- **sort[column]** (string) - Optional - Column to sort by
- **sort[direction]** (string) - Optional - Sort direction (asc or desc)

### Response
#### Success Response (200)
- **data** (array<api.apiClientAccessDto>)
- **pagination** (dto.Pagination)
```

--------------------------------

### GET /api/api-access/{clientId}/apis

Source: https://pocket-id.org/docs/api

Get every API the OIDC client may request tokens for, with its access and permissions split into user-delegated and client (machine-to-machine) access.

```APIDOC
## GET /api/api-access/{clientId}/apis

### Description
Get every API the OIDC client may request tokens for, with its access and permissions split into user-delegated and client (machine-to-machine) access.

### Method
GET

### Endpoint
/api/api-access/{clientId}/apis

### Parameters
#### Path Parameters
- **clientId** (string) - Required - OIDC Client ID

### Response
#### Success Response (200)
- **api** (api.apiResponseDto) - API details
- **cimdGrantedAccess** (boolean) - CIMD granted access status
- **cimdGrantedPermissionIds** (array<string>) - List of CIMD granted permission IDs
- **clientAccess** (boolean) - Client access status
- **clientPermissionIds** (array<string>) - List of client permission IDs
- **userDelegatedAccess** (boolean) - User delegated access status
- **userDelegatedPermissionIds** (array<string>) - List of user delegated permission IDs
```

--------------------------------

### Configure ezBookkeeping via Environment Variables

Source: https://pocket-id.org/docs/client-examples/ezbookkeeping

Set the required environment variables to enable OIDC authentication in ezBookkeeping.

```bash
EBK_AUTH_ENABLE_OAUTH2_AUTH=true
EBK_AUTH_OAUTH2_PROVIDER=oidc
EBK_AUTH_OAUTH2_CLIENT_ID=<Client ID>
EBK_AUTH_OAUTH2_CLIENT_SECRET=<Client secret>
EBK_AUTH_OIDC_PROVIDER_BASE_URL=<Issuer URL>
EBK_AUTH_ENABLE_OIDC_DISPLAY_NAME=true
EBK_AUTH_OIDC_CUSTOM_DISPLAY_NAME=Pocket ID
```

--------------------------------

### GET /api/oidc/clients/{id}/preview/{userId}

Source: https://pocket-id.org/docs/api

Get a preview of the OIDC data (ID token, access token, userinfo) that would be sent to the client for a specific user.

```APIDOC
## GET /api/oidc/clients/{id}/preview/{userId}

### Description
Get a preview of the OIDC data (ID token, access token, userinfo) that would be sent to the client for a specific user.

### Method
GET

### Endpoint
/api/oidc/clients/{id}/preview/{userId}

### Parameters
#### Path Parameters
- **id** (string) - Required - Client ID
- **userId** (string) - Required - User ID to preview data for

#### Query Parameters
- **scopes** (string) - Optional - Scopes to include in the preview (comma-separated)

### Response
#### Success Response (200)
- **accessToken** (map<string, object>) - Access token payload
- **idToken** (map<string, object>) - ID token payload
- **userInfo** (map<string, object>) - Userinfo payload
```

--------------------------------

### POST /api/signup

Source: https://pocket-id.org/docs/api

Create a new user account.

```APIDOC
## POST /api/signup

### Description
Create a new user account.

### Method
POST

### Endpoint
/api/signup

### Request Body
- **email** (string) - Optional
- **firstName** (string) - Optional
- **lastName** (string) - Optional
- **token** (string) - Optional
- **username** (string) - Required

### Response
#### Success Response (201)
- **customClaims** (array<dto.CustomClaimDto>)
- **disabled** (boolean)
- **displayName** (string)
- **email** (string)
- **emailVerified** (boolean)
- **firstName** (string)
- **id** (string)
- **isAdmin** (boolean)
- **lastName** (string)
- **ldapId** (string)
- **locale** (string)
- **userGroups** (array<dto.UserGroupMinimalDto>)
- **username** (string)
```

--------------------------------

### POST /api/signup-tokens

Source: https://pocket-id.org/docs/api

Create a new signup token that allows user registration.

```APIDOC
## POST /api/signup-tokens

### Description
Create a new signup token that allows user registration.

### Method
POST

### Endpoint
/api/signup-tokens

### Request Body
- **ttl** (utils.JSONDuration) - Required
- **usageLimit** (integer) - Required
- **userGroupIds** (array<string>) - Optional

### Response
#### Success Response (201)
- **createdAt** (string)
- **expiresAt** (string)
- **id** (string)
- **token** (string)
- **usageCount** (integer)
- **usageLimit** (integer)
- **userGroups** (array<dto.UserGroupMinimalDto>)
```

--------------------------------

### GET /api/application-images/favicon

Source: https://pocket-id.org/docs/api

Retrieves the application favicon.

```APIDOC
## GET /api/application-images/favicon

### Description
Get the favicon for the application.

### Method
GET

### Endpoint
/api/application-images/favicon

### Response
#### Success Response (200)
- **file** (file) - Favicon image
```

--------------------------------

### GET /api/application-images/email

Source: https://pocket-id.org/docs/api

Retrieves the email logo image.

```APIDOC
## GET /api/application-images/email

### Description
Get the email logo image for use in emails.

### Method
GET

### Endpoint
/api/application-images/email

### Response
#### Success Response (200)
- **file** (file) - Email logo image
```

--------------------------------

### Configure AirTrail via .env file

Source: https://pocket-id.org/docs/client-examples/airtrail

Use these environment variables to enable and configure OAuth authentication in AirTrail.

```bash
OAUTH_ENABLED=true
OAUTH_ISSUER_URL=https://<pocket-id-domain.tld>/.well-known/openid-configuration
OAUTH_CLIENT_ID=xxxxx-xxxxx-xxxxx 
OAUTH_CLIENT_SECRET=xxxxx-xxxxx-xxxxx
```

--------------------------------

### GET /api/application-images/background

Source: https://pocket-id.org/docs/api

Retrieves the application background image.

```APIDOC
## GET /api/application-images/background

### Description
Get the background image for the application.

### Method
GET

### Endpoint
/api/application-images/background

### Response
#### Success Response (200)
- **file** (file) - Background image
```

--------------------------------

### Set Client Launch URL

Source: https://pocket-id.org/docs/client-examples/inventree

The base URL for the InvenTree instance.

```text
https://<inventree-domain.tld>
```

--------------------------------

### GET /api/application-images/default-profile-picture

Source: https://pocket-id.org/docs/api

Retrieves the default profile picture image.

```APIDOC
## GET /api/application-images/default-profile-picture

### Description
Get the default profile picture image for the application.

### Method
GET

### Endpoint
/api/application-images/default-profile-picture

### Response
#### Success Response (200)
- **file** (file) - Default profile picture image
```

--------------------------------

### Configure Open WebUI Environment Variables

Source: https://pocket-id.org/docs/client-examples/open-webui

Add these variables to your Open WebUI docker .env file to enable OIDC authentication via Pocket ID.

```bash
ENABLE_OAUTH_SIGNUP=true
  OAUTH_CLIENT_ID=<client id from pocket ID>
  OAUTH_CLIENT_SECRET=<client secret from pocket ID>
  OAUTH_PROVIDER_NAME="Pocket ID"
  OPENID_PROVIDER_URL=https://<your pocket id url>/.well-known/openid-configuration
  OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true

# For group management, you can use the following variables:
  ENABLE_OAUTH_ROLE_MANAGEMENT=true
  ENABLE_OAUTH_GROUP_MANAGEMENT=true
  ENABLE_OAUTH_GROUP_CREATION=true
# Make sure those match the ones you set up before in Pocket-ID
  OAUTH_ALLOWED_ROLES="users, admins"
  OAUTH_ADMIN_ROLES=admins
  OAUTH_ROLES_CLAIM=groups
  OAUTH_SCOPES="openid email profile groups"

# Optional but useful variables:

# So users are immediately added instead of being "pending"
  DEFAULT_USER_ROLE=user
# Make Pocket-ID the only auth method
# comment out if you need access via password
  ENABLE_LOGIN_FORM=false
# Make Pocket-ID the source of truth for the profile pictures
  OAUTH_UPDATE_PICTURE_ON_LOGIN=true
```

--------------------------------

### Enable Local Credentials Fallback

Source: https://pocket-id.org/docs/client-examples/homarr

Optional configuration to allow local account login alongside OIDC.

```bash
AUTH_PROVIDERS=oidc,credentials
```

--------------------------------

### GET /api/apis/{id}

Source: https://pocket-id.org/docs/api

Retrieve a single API including its permissions.

```APIDOC
## GET /api/apis/{id}

### Description
Retrieve a single API including its permissions.

### Method
GET

### Endpoint
/api/apis/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - API ID

### Response
#### Success Response (200)
- **allowCimdClients** (boolean) - CIMD client allowance
- **createdAt** (string) - Creation timestamp
- **id** (string) - API ID
- **name** (string) - API name
- **permissions** (array<api.apiPermissionResponseDto>) - List of permissions
- **resource** (string) - API resource
```

--------------------------------

### Configure Tandoor Environment Variables

Source: https://pocket-id.org/docs/client-examples/tandoor-recipes

Set these variables in your Tandoor .env file to enable OpenID Connect authentication. Replace the placeholders with your specific Pocket ID client credentials and domain.

```bash
SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid_connect
SOCIALACCOUNT_PROVIDERS='{"openid_connect":{"APPS":[{"provider_id":"pocket-id","name":"Pocket ID","client_id":"<pocket-id-client-id>","secret":"<pocket-id-client-secret>","settings":{"server_url":"https://<your-pocket-id-domain>/.well-known/openid-configuration"}}]}}'
```

--------------------------------

### Create oauth2-proxy configuration file

Source: https://pocket-id.org/docs/client-examples/healthchecks

Define the OIDC provider settings, upstreams, and security policies in oauth2-proxy.cfg.

```text
provider_display_name="Pocket ID"
provider="oidc"
oidc_issuer_url="<<Pocket ID URL>>"
client_id="<<Client ID>>"
client_secret="<<Client Secret>>"
cookie_secret="xxx" # generate with: openssl rand -base64 32 | tr -- '+/' '-_'
upstreams="http://healthchecks:8000" # internal port
code_challenge_method="S256" # PKCE challenges plain or S256
skip_auth_routes = [".*/ping", ".*/api", ".*/badge"]
reverse_proxy = true
redirect_url="https://hc.example.com/oauth2/callback"
scope = "openid email profile groups"

cookie_expire="0" # seconds, 0 for session
cookie_name="__Host-oauth2-proxy" # or __Secure-oauth2-proxy (less secure)
cookie_secure="true"
email_domains = ["*"]
http_address="0.0.0.0:4180"
insecure_oidc_allow_unverified_email = "true"
```

--------------------------------

### GET /api/users/{id}

Source: https://pocket-id.org/docs/api

Retrieve detailed information about a specific user.

```APIDOC
## GET /api/users/{id}

### Description
Retrieve detailed information about a specific user.

### Method
GET

### Endpoint
/api/users/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - User ID

### Response
#### Success Response (200)
- **customClaims** (array<dto.CustomClaimDto>)
- **disabled** (boolean)
- **displayName** (string)
- **email** (string)
- **emailVerified** (boolean)
- **firstName** (string)
- **id** (string)
- **isAdmin** (boolean)
- **lastName** (string)
- **ldapId** (string)
- **locale** (string)
- **userGroups** (array<dto.UserGroupMinimalDto>)
- **username** (string)
```

--------------------------------

### GET /api/custom-claims/suggestions

Source: https://pocket-id.org/docs/api

Retrieves a list of suggested custom claim names.

```APIDOC
## GET /api/custom-claims/suggestions

### Description
Get a list of suggested custom claim names.

### Method
GET

### Endpoint
/api/custom-claims/suggestions

### Response
#### Success Response (200)
- **body** (array<string>) - List of suggested custom claim names
```

--------------------------------

### Configure Vikunja via Environment Variables

Source: https://pocket-id.org/docs/client-examples/vikunja

Alternative OIDC configuration using environment variables.

```bash
VIKUNJA_AUTH_OPENID_ENABLED: "true"
VIKUNJA_AUTH_OPENID_PROVIDERS_POCKETID_AUTHURL: https://id.example.net
VIKUNJA_AUTH_OPENID_PROVIDERS_POCKETID_CLIENTID: <POCKET_ID_CLIENT_ID>
VIKUNJA_AUTH_OPENID_PROVIDERS_POCKETID_CLIENTSECRET: <POCKET_ID_SECRET>
VIKUNJA_AUTH_OPENID_PROVIDERS_POCKETID_NAME: PocketID
VIKUNJA_AUTH_OPENID_PROVIDERS_POCKETID_SCOPE: "openid profile email"
```

--------------------------------

### Configure Outline OIDC Environment Variables

Source: https://pocket-id.org/docs/client-examples/outline

Add these variables to the Outline container's docker.env file to enable OIDC authentication.

```text
OIDC_CLIENT_ID=Client ID
OIDC_CLIENT_SECRET=Client Secret
OIDC_AUTH_URI=Authorization URL
OIDC_TOKEN_URI=Token URL
OIDC_USERINFO_URI=Userinfo URL
OIDC_LOGOUT_URI=Logout URL

OIDC_DISPLAY_NAME=Pocket ID
OIDC_USERNAME_CLAIM=preferred_username
OIDC_SCOPES=openid profile email groups
```

--------------------------------

### Configure Gotify Environment Variables

Source: https://pocket-id.org/docs/client-examples/gotify

Required environment variables for enabling OIDC in Gotify.

```bash
GOTIFY_OIDC_ENABLED=true
GOTIFY_OIDC_ISSUER=https://auth.example.org
GOTIFY_OIDC_CLIENTID=YOUR_CLIENT_ID
GOTIFY_OIDC_CLIENTSECRET=YOUR_CLIENT_SECRET
GOTIFY_OIDC_REDIRECTURL=https://gotify.example.org/auth/oidc/callback
GOTIFY_OIDC_AUTOREGISTER=true
GOTIFY_OIDC_USERNAMECLAIM=preferred_username
GOTIFY_OIDC_LINK_BY_USERNAME=false
GOTIFY_OIDC_SCOPES=openid,profile,email
```

--------------------------------

### GET /api/users/{id}/groups

Source: https://pocket-id.org/docs/api

Retrieve all groups a specific user belongs to.

```APIDOC
## GET /api/users/{id}/groups

### Description
Retrieve all groups a specific user belongs to.

### Method
GET

### Endpoint
/api/users/{id}/groups

### Parameters
#### Path Parameters
- **id** (string) - Required - User ID

### Response
#### Success Response (200)
- **allowedOidcClients** (array<dto.OidcClientMetaDataDto>) - List of allowed OIDC clients
- **createdAt** (string) - Creation timestamp
- **customClaims** (array<dto.CustomClaimDto>) - Custom claims associated with the group
- **friendlyName** (string) - Friendly name of the group
- **id** (string) - Group ID
- **ldapId** (string) - LDAP identifier
- **name** (string) - Group name
- **users** (array<dto.UserDto>) - List of users in the group
```

--------------------------------

### Configure BetterShift .env variables

Source: https://pocket-id.org/docs/client-examples/bettershift

Add these environment variables to the BetterShift .env file, replacing placeholders with the credentials obtained from the Pocket ID OIDC client setup.

```bash
CUSTOM_OIDC_ENABLED=true
CUSTOM_OIDC_NAME=Login with PocketID # BUTTON_TEXT
CUSTOM_OIDC_CLIENT_ID=<your OIDC-Discovery-URL from above>
CUSTOM_OIDC_CLIENT_SECRET=<your client secret from above>
CUSTOM_OIDC_ISSUER=<your OIDC-Discovery-URL from above>
CUSTOM_OIDC_SCOPES=openid profile email  # Space-separated list
```

--------------------------------

### GET /api/users/{id}/profile-picture.png

Source: https://pocket-id.org/docs/api

Retrieve the profile picture for a specific user.

```APIDOC
## GET /api/users/{id}/profile-picture.png

### Description
Retrieve a specific user's profile picture.

### Method
GET

### Endpoint
/api/users/{id}/profile-picture.png

### Parameters
#### Path Parameters
- **id** (string) - Required - User ID

### Response
#### Success Response (200)
- **file** (PNG image) - The user's profile picture
```

--------------------------------

### GET /api/users/{id}/groups

Source: https://pocket-id.org/docs/api

Retrieve all groups a specific user belongs to.

```APIDOC
## GET /api/users/{id}/groups

### Description
Retrieve all groups a specific user belongs to.

### Method
GET

### Endpoint
/api/users/{id}/groups

### Parameters
#### Path Parameters
- **id** (string) - Required - User ID

### Response
#### Success Response (200)
- **allowedOidcClients** (array<dto.OidcClientMetaDataDto>)
- **createdAt** (string)
- **customClaims** (array<dto.CustomClaimDto>)
- **friendlyName** (string)
- **id** (string)
- **ldapId** (string)
- **name** (string)
- **users** (array<dto.UserDto>)
```
Tokens:
Raw