# React SPA silent token refresh

**URL:** <https://devforum.okta.com/t/react-spa-silent-token-refresh/11788>\
**Category:** Questions\
**Created:** [November 18, 2020, 12:36am UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788 "2020-11-18T00:36:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bollarampavan](https://avatars.discourse-cdn.com/v4/letter/b/958977/32.png) [@bollarampavan](https://devforum.okta.com/u/bollarampavan)\
**Post date:** [November 18, 2020, 12:36am UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788/1 "2020-11-18T00:36:33Z")

</div>

I am having hard time understanding OKTA refresh tokens.i have looked for documentation in okta developer forum and found that i should be calling ‘/v1/authorize?prompt=none’. but question is from where ? i am using @okta/okta-react and don’t know how to capture token expiration event.  
below is my configuration

const config = {  
issuer: process.env.REACT\_APP\_OKTA\_ORG\_URL,  
redirect\_uri: `${window.location.origin}/implicit/callback`,  
client\_id: process.env.REACT\_APP\_OKTA\_CLIENT\_ID,  
scope: [‘openid’, ‘profile’, ‘email’, ‘groups’],  
pkce: true,  
cookies: {  
secure: window.location.protocol === ‘https:’,  
},

```
tokenManager: {
  autoRenew: true,
  secure: true,
  storage: 'localStorage',
}

```

};

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [November 18, 2020, 1:51am UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788/2 "2020-11-18T01:51:44Z")

</div>

The React SDK has a feature [enabled by default that handles token renewal for you](https://github.com/okta/okta-react#configuration-options), but your configuration also shows that you have this feature, `autoRenew` set to true as well.

Are you not seeing silent token renewals after your user’s tokens expire?

---

<div class="post-metadata">

**Author:** ![bollarampavan](https://avatars.discourse-cdn.com/v4/letter/b/958977/32.png) [@bollarampavan](https://devforum.okta.com/u/bollarampavan)\
**Post date:** [November 18, 2020, 4:43am UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788/3 "2020-11-18T04:43:07Z")

</div>

yes i just verified that it is working good but just some times app is throwing authentication error sometimes (OKTA PKCE verification failed) which led me to believe that renewal is failed.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [November 18, 2020, 6:48pm UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788/4 "2020-11-18T18:48:18Z")

</div>

Usually when you encounter that error, there is a concurrency issue where multiple authorize calls are being made _before_ the SDK is able to request a token. That would also explain why you only sometimes see that occurring.

The reason this is causing an issue is that, when the SDK makes the authorize request, it stores in the browser the code\_verifier that was created for PKCE authentication. If another authorize request is made _before the authorization code from the first authorize request is exchanged for tokens_, a new code\_verifier, for the subsequent authorize request(s), will be sent in the token request and this error will be thrown as the code\_challenge from the authorize request will not match the one sent in the token request as is expected.

Are you using the SDK’s callback component? Is it possible that the page the user is on is attempting to make multiple authorize requests (I recommend reviewing the network events that occur when this happens to check)?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [November 18, 2020, 6:52pm UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788/5 "2020-11-18T18:52:08Z")

</div>

Side note, I use [this tool](https://tonyxu-io.github.io/pkce-generator/) to check which authorize request’s code challenge corresponds to the code verifier being sent in a failed token request when I suspect this is occurring.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 26, 2024, 11:32pm UTC](https://devforum.okta.com/t/react-spa-silent-token-refresh/11788/6 "2024-01-26T23:32:11Z")

</div>

Closed on January 26, 2024, 11:32pm UTC