Open source · MIT · Self-hosted
Claviger is an open-source backend with passkeys built in. It runs on your own server, keeps your data there, and lets in exactly the people who should be let in.
Who it is for
Claviger keeps everything that makes PocketBase pleasant for developers, and adds the identity features that congregations keep asking their software for.
Features
Available works todayRoadmap planned, not built yetBeing fixed built, with a known bug
Register, sign in, list and revoke passkeys on any auth collection. A passkey also counts as a second factor.
An email link that lets a member enrol again after losing every device. The flow is built, and a known bug is being fixed.
Collections, API rules, realtime, files, password, OAuth2, one-time code and MFA sign-in, and the admin screen.
Send warnings and errors to your own collector, alongside the built-in log table.
During a rolling deploy, the new copy waits for the old one to let go of the database.
Act as an OpenID Connect provider, so one passkey opens every app you run.
Families as one unit. Guardians manage their children's records, and teenagers can leave the household when they come of age.
Access to children's records follows a volunteer's training and background check, and ends when either lapses.
Matching pickup codes, an approved-pickup list and a full check-in log.
Staff who know a member by sight can issue a one-time setup code, and every code is logged.
Prayer requests and care notes with visibility levels. Emergency access is always logged.
An append-only change history, and field encryption for the most sensitive data.
How it works
Clone the repository and start it with Docker. The database lives in a folder next to it.
docker compose up --build
# admin screen: http://127.0.0.1:8090/_/Enable passkeys on an auth collection with webauthn.enabled. Members enrol from their phone or laptop.
The PocketBase SDKs work for everything else. Passkey sign-in is two calls:
POST /api/collections/users/auth-with-webauthn/login-begin
POST /api/collections/users/auth-with-webauthn/login-finishThere are no prebuilt downloads yet. You can also build it with Go; the README has the details.
Questions
KLAV-ih-jer. Church Latin speakers say KLAH-vee-jer, and that is fine too. It is Latin for “key-bearer”.
A key-bearer decides who comes in. The crossed keys echo the keys of St. Peter, a sign of trust that many traditions share. They stand for what the software does: it holds the keys, and it opens the right doors.
No. The congregation features are for any church, synagogue, mosque or faith community, and everything else is a general-purpose backend for any app.
Claviger is built on PocketBase by Gani Georgiev, under the MIT licence. We follow upstream releases and keep the API compatible, so the PocketBase SDKs keep working.
On the server where you run Claviger, in SQLite files you can back up and move. Nothing is sent to us.
Yes. A passkey is the phone's fingerprint or face check, with nothing to remember. Reset by email link is being repaired, and recovery that the parish office can vouch for is on the roadmap.
Passkey sign-in already runs a parish's sign-in in production. Features marked Roadmap are not built yet, and this page says so wherever they appear.