Configuring SSO on Mastodon

Using PocketID for passwordless authentication for my Mastodon instanceI have been on a roll adding SSO (with PocketID) to all my self-hosted services. One of the items on my list was my Mastodon instance. There is no official Mastodon documentation for setting up SSO yet. The documentation page is still a WIP so this post may be a useful reference in the meantime for anyone trying to set this up. I created a new OIDC client in PocketID as follows: I set the callback URL to https://social.ketupat.me/auth/auth/openid_connect/callback. I then added the following environment variables to my Mastodon deployment: OIDC_ENABLED=true OIDC_DISPLAY_NAME=PocketID OIDC_ISSUER=[insert PocketID URL here] OIDC_DISCOVERY=true OIDC_SCOPE=openid,profile,email OIDC_CLIENT_ID=[insert PocketID client ID] OIDC_CLIENT_SECRET=[insert PocketID client secret] OIDC_REDIRECT_URI=https://social.ketupat.me/auth/auth/openid_connect/callback If the email address of your OIDC entity is different from the email…