Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 identity provider centered on passkey (WebAuthn) authentication. In production it acts as an authentication gateway: it serves the OIDC/OAuth endpoints (authorization code with PKCE, device authorization, client credentials, pushed authorization requests, token introspection, userinfo, end-session), performs WebAuthn registration/login ceremonies, issues and rotates signed JWTs, and exposes a SvelteKit admin console for managing users, groups, OIDC clients, API permissions, API keys, application config, and audit logs. It also supports SCIM 2.0 provisioning, LDAP directory sync, one-time access codes, email verification, signup flows, and transactional email notifications with per-user locale. Architecturally it is a modular monolith: a Go backend (backend/cmd/main.go as the entry point) built on Gin, GORM, and a fork of the Fosite OIDC framework, with the SvelteKit frontend embedded and served by the same process. Data flows are typical of an IdP: browser/SP clients hit OIDC endpoints, the backend persists users, tokens, clients, and audit events to SQLite or PostgreSQL (50+ up/down migrations for each), reads/writes user content through a filesystem/S3/database storage abstraction, and delegates ephemeral state and cron jobs (token cleanup, API key expiry, back-channel logout, rate limiting) to the Francis actor runtime. External dependencies include SMTP servers, LDAP directories, SCIM providers, MaxMind GeoLite2 downloads for audit-log geolocation, optional S3-compatible object storage, and optional standalone Francis. The codebase shows strong engineering discipline: dependency-injected services, a layered DTO mapping and validation layer with stable error codes, an authorization scope catalog enforced at the router level, middleware for CSP/CORS/rate limiting/CSRF, a generic TTL cache with singleflight, SSRF-guarded outbound HTTP with per-purpose host allowlists, field-level encrypted strings, and callback-URL wildcard validation. Tests are extensive and include Go unit tests, migration parity checks between SQLite and PostgreSQL, route-scope coverage tests, and Playwright E2E suites. The main maintenance risks are the forked Fosite dependency, the non-trivial operator complexity of the Francis actor runtime, and a high rate of schema migrations; HA mode is explicitly experimental. This is unambiguously an application repository; its only data-adjacent features are IP-geolocation enrichment and an opt-in analytics heartbeat.