Skip to main content
Every person exists once, in Pocket-ID (https://pocket-id.augustin.ai). Apps sign people in with Pocket-ID and create their profile the first time they log in. Two groups decide what a person can reach:
  • guest: the shared apps below, as a normal user.
  • admins: everything, as an admin, including the apps behind the shared Envoy gate (which only lets admins through).

​
Add a person

  1. Pocket-ID → Administration → Users → Add user. Username is lowercase and becomes their username in every app (Jellyfin, Seerr, BookOrbit, RomM). Email is required. Leave Admin off.
  2. Groups: tick guest (or admins).
  3. User row → ⋯ → Login code → pick an expiry (one day is fine) → copy the link (https://pocket-id.augustin.ai/lc/<code>) and send it to them. Opening it signs them in once; Pocket-ID then asks them to add a passkey. After that they sign in with the passkey everywhere.
If the person already has a Jellyfin account (Ella, Erin, Jim), give them the same username in Pocket-ID. Their first SSO login attaches to the existing Jellyfin user, so watch history and favourites stay.

​
What they get

​
Jellyfin SSO setup (lives in Jellyfin’s config PVC, not git)

  • Plugin: SSO Authentication from the maintained fork’s repository https://raw.githubusercontent.com/k0lin/jellyfin-plugin-sso/manifest-release/manifest.json (Dashboard → Plugins → Repositories). Version 5.0.x is the line for Jellyfin 10.11; 5.1+ needs Jellyfin 12. The original 9p4 repository is archived.
  • Provider name pocketid, Pocket-ID client id jellyfin (callback https://jellyfin.augustin.ai/sso/OID/redirect/pocketid, PKCE, groups admins + guest), role claim groups, roles admins,guest, admin role admins, username claim preferred_username, scheme override https.
  • The login button is the branding “Login disclaimer” (Dashboard → General → Branding), a form posting to /sso/OID/start/pocketid.
  • The plugin writes its config, client secret and user links to /config/data/plugins/configurations/SSO-Auth.xml at runtime, so it is not managed from git; the PVC backup covers it. Rotate the secret by adding a new one on the Pocket-ID client and re-saving the plugin settings.
  • Break-glass: augustin keeps a local Jellyfin password (in the vault under jellyfin.augustin.ai / augustin). There is no separate admin user.

​
Asking the assistant to add someone

The Pocket-ID admin API (STATIC_API_KEY in the pocket-id secret, header X-API-Key) covers the whole flow:
  • POST /api/users with username, email, names and userGroupIds creates the user in the right group.
  • POST /api/users/<id>/one-time-access-token with {"ttl": <seconds>} returns a token; the setup link is https://pocket-id.augustin.ai/lc/<token>.
  • POST /api/users/<id>/one-time-access-email emails the link instead (needs SMTP configured in Pocket-ID).
Give the assistant the name, username, email and group.