Your database
PostgreSQL with the full Passkey-X schema, applied and upgraded by one script. Backups follow your own policy.
Self-hosting · Custom
Passkey-X on your own servers.
Run the whole Passkey-X server in your data center or private cloud: the database, sign-in, API and web app on your domain, with no dependency on passkey-x.com. Your people get the same vault, admin console and apps.
Zero-knowledge on any server Your keys, your domain Docker Compose
What runs on your server
Everything, on infrastructure you control.
Your API and sign-in
Sign-in, the data API, file storage, live device control and background jobs run in Docker behind one gateway.
Your web address
The Passkey-X web app is built for your domain, with the same security headers as passkey-x.com.
Still zero-knowledge
Vaults are encrypted on each device before upload. Your server stores ciphertext, exactly like ours.
Set up
Four steps to your own Passkey-X.
- Step 1
Prepare a server
A Linux machine with Docker, and two DNS names: one for the web app and one for the API.
- Step 2
Generate your keys
setup.sh creates every secret and writes a private .env file. Nothing is printed or sent anywhere.
- Step 3
Create the database
migrate.sh applies all migrations, and is safe to run again on every upgrade.
- Step 4
Start and connect
Build the web app, start the stack with Docker Compose and point your apps at your address.
Apps
Every Passkey-X app connects to your address.
Each server publishes a small public file at /.well-known/passkey-x.json that tells the apps where everything is.
Web
Served by your server at your own address.
Android
Sign-in › Change › Server address, or push it with device management (server_url).
Desktop and extension
Build your own copies for your address with one script, then deploy them with your usual tools.
CLI and Controller
passkey-x server set vault.example.com, or enroll the Controller with -server.
Questions
Self-hosting FAQ
Prefer us to run it? The hosted service at passkey-x.com includes updates, backups and the shared threat feed. See plans
Which plan includes self-hosting?
Custom, our contract version of Enterprise. Talk to us about a pilot: we help with sizing, the first install and upgrades.
Is my data still end-to-end encrypted?
Yes. Encryption happens on each device with keys derived from the vault password, so the server only ever stores ciphertext, whether it is ours or yours.
What works differently on a self-hosted server?
Billing is off (plans are set by your administrator), text-message codes need your own SMS provider, and the shared Passkey-X AI scam checks and threat feed need keys from us. Everything else, including the admin console, SSO and SCIM, audit and the apps, works the same.
Can our people use the official apps?
The web app and Android connect to any server address. The desktop app and browser extension are built for your address with the included script, so they get their own extension ID and only talk to your server.
How are upgrades handled?
Pull the new release, run migrate.sh and restart the stack. Migrations are applied in order and are safe to run more than once.
Want Passkey-X inside your network?
Tell us about your environment and we’ll plan a self-hosted pilot with you.