# Using session token to get refresh token (okta authentication api)

**URL:** <https://devforum.okta.com/t/using-session-token-to-get-refresh-token-okta-authentication-api/3314>\
**Category:** OAuth/OIDC\
**Tags:** api\
**Created:** [November 7, 2018, 9:14pm UTC](https://devforum.okta.com/t/using-session-token-to-get-refresh-token-okta-authentication-api/3314 "2018-11-07T21:14:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erahamim](https://avatars.discourse-cdn.com/v4/letter/e/3d9bf3/32.png) [@erahamim](https://devforum.okta.com/u/erahamim)\
**Post date:** [November 7, 2018, 9:14pm UTC](https://devforum.okta.com/t/using-session-token-to-get-refresh-token-okta-authentication-api/3314/1 "2018-11-07T21:14:37Z")

</div>

Hello  
We would like to have an ios app with our own login experience (no redirect to okta login page) and with the use of MFA.  
As far as we could understand the regular flows of openid connect will not allow to do that (because of the use of MFA).

So we built authentication flow base on okta api. We are able to authenticate, enroll/activate/verify MFA and getting one time session token and replace it with access token using /authorize api (response\_type=token id\_token).  
The only problem we have is that we are not able to obtain refresh token.

In short the flow is  
Authenticate-\>MFA verify-\>exchange session token with access token.  
How do we get refresh token?

The flows on the /authorize require us to do additional authentication without MFA which we don’t want.  
The flows on /token require that you already have a refresh token.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 7:05pm UTC](https://devforum.okta.com/t/using-session-token-to-get-refresh-token-okta-authentication-api/3314/2 "2024-02-12T19:05:32Z")

</div>