Retrieve an Okta Refresh Token and Supported Authentication Flows

Okta requires enabling the refresh token grant type in the OpenID Connect (OIDC) application settings to retrieve a refresh token. The Authorization Code and Resource Owner Password flows support refresh token retrieval by including the offline_access scope in the request. Administrators must configure the application and format the requests correctly to obtain the token.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• /token request endpoint
• Refresh token functionality

Which authentication flows support retrieving a refresh token?

Review the supported authentication flows for obtaining a refresh token:

• Authorization Code flow
• Resource Owner Password

What prerequisites are required to retrieve a refresh token?

Enable the refresh token grant type in the OpenID Connect (OIDC) application settings by navigating through the Okta Admin Console and selecting the appropriate grant type.

1. In the Okta Admin Console, navigate to Applications and select the OIDC client.
2. Go to General Settings.
3. Select Grant type and ensure the refresh token grant type is enabled.
   
    

How does the Authorization Code flow retrieve a refresh token?

Retrieve the refresh token using the Authorization Code flow by including the offline_access scope in the authorization request and executing the token call.

1. Include the offline_access scope in the authorization request.
   
   

   https://<OktaDomain>/oauth2/v1/authorize?
   client_id=<client_id>&
   response_type=code&scope=openid offline_access&
   redirect_uri=https%3A%2F%2Fexample.com&
   state=state-296bc9a0-a2a2-4a57-be1a-d0e2fd9bb601

2. The next step of the flow is the /token call. (grant_type: authorization_code)
   The response returned from the /token request will contain the id_token, access_token, and refresh_token.

How does the Resource Owner Password flow retrieve a refresh token?

Retrieve the refresh token using the Resource Owner Password flow by including the offline_access scope directly in the token request.

1. Include the offline_access scope in the /token request.
   
   

   curl --location 'https://<OktaDomain>/oauth2/v1/token' \
   --header 'Accept: application/json' \
   --header 'Authorization: Basic <authorization_hash>' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'grant_type=password' \
   --data-urlencode 'username=<user@domain.com>' \
   --data-urlencode 'password=<password>' \
   --data-urlencode 'scope=openid offline_access'

In this flow, the /token call is the only step and its response will contain the id_token, access_token, and refresh_token.

Related References

• Refresh access tokens and rotate refresh tokens | Okta Developer
• Understand the token lifecycle (exchange, refresh, revoke) | Okta Developer