Okta Refresh Token Unexpectedly Returns as Invalid During Native to Web SSO or SSO for Native Apps

A refresh token unexpectedly returns as invalid despite not expiring when performing Native to Web Single Sign-On (SSO) or SSO for Native apps. This occurs because the interclient_access or device_sso scopes bind the refresh token to a session, causing the token to become invalid when the session expires. Configure the Okta session policy for a longer duration or request these scopes only when necessary to resolve the issue.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Native to Web Single Sign-On
• SSO for Native applications
• Refresh tokens

This behavior occurs when requesting the interclient_access or device_sso scope. These scopes bind a refresh token to a session. When the session is no longer valid, the refresh token also becomes invalid.

What resolves the invalid refresh token issue?

Extend the Okta session policy duration and adjust the application logic to request specific scopes only when necessary.

• Configure the Okta session policy to remain valid for a longer duration.
• Implement application logic to request the interclient_access or device_sso scope only when necessary.

NOTE: If an external Identity Provider (IdP) sources the user, the IdP controls the session rather than Okta, which ties the refresh token to the IdP session.