Per the documentation (OIN submission requirements | Okta Developer):
The offline_access scope isn’t available because refresh tokens aren’t supported for integrations published in the OIN.
I don’t quite understand the logic there, but I’m willing to accept it. I just wonder how do we handle longer-lived sessions than 1 hour? If I can’t use a refresh token on the backend then I’ll have to send the user to okta for an oauth dance every hour, possibly disturbing their work. This sounds very sub-optimal to me. Is there an alternative to refresh tokens?
Related question Is it possible to refresh token in OIDC application published to OIN? but this was 3 years ago, I am hoping something changed, or that someone has an alternative to sending the user back to Okta once an hour to check account validity.