Authorize Endpoint does not return Refresh Token or Code

[vijet]

Hi @lorinw00,

According to this documentation - Refresh access tokens | Okta Developer

Authorization code with PKCE requests don't return refresh tokens if they are sent from SPAs or other browser-based apps. Instead, you can silently refresh tokens by making a call to the /authorize endpoint.

Follow this - Refresh access tokens | Okta Developer

Also, the authorization code is an intermediate token that will be exchanged for an access/ID token. It is not saved in the browser local storage AFAIK.

These prior discussions might also help -
https://support.okta.com/help/s/question/0D51Y00005xyT6j/spa-oauth-flow-recommendation-and-token-refresh?language=en_US

Refresh token in implicit flow OIDC (SPA apps)

Hello, I’ve setup an SPA application in OKTA and that does not give the option to retrieve Refresh token. Is it possible to retrieve a refresh token using SPA applications? What would be the best approach to avoid redirecting the user to login in OKTA when the token gets expired? Thanks, Susana