Trying to obtain a refresh token from Okta's Authorization Server or the Custom Authorization Server using Authorization Code, Authorization Code w/ PKCE, or Resource Owner Password flows does not result in a refresh token being returned, even when the offline_access scope is requested.

Example of a call using Org Authorization Server:

POST https://{OktaDomain}.okta.com/oauth2/v1/token
grant_type=password
&username=example%40mailinator.com
&password=a.gReAt.pasSword
&scope=openid%20offline_access

Example of a call using Custom Authorization Server:

POST https://{OktaDomain}.okta.com/oauth2/{authorizationServerID}/v1/token
grant_type=password
&username=example%40mailinator.com
&password=a.gReAt.pasSword
&scope=openid%20offline_access

• OAuth 2.0
• OpenID Connect (OIDC)
• Okta Classic Engine

The API calls are correct. However, the OIDC app prerequisite has not been met. After configuring an OIDC application in the Admin UI, ensure that the Grant type includes the Refresh Token.

To enable the retrieval of a "Refresh Token":

1. Navigate to the OIDC app in the Admin UI.
2. Click the General tab.
3. Locate Grant type in the General Settings section.
4. Ensure Refresh Token is selected, as shown in the screenshot below.

Related References

• Authorization Code
• Authorization Code w/ PKCE
• Resource Owner Password
• Refresh access tokens and rotate refresh tokens