What Is a Refresh Token? 

A refresh token is a special token that is used to generate additional access tokens. This allows you to have short-lived access tokens without having to collect credentials every single time one expires. You request this token alongside the access and/or ID tokens as part of a user's initial authentication flow.

Setting Up Your Application 

Refresh tokens are available for a subset of Okta OAuth 2.0 Client Applications, specifically web or native applications. For more about creating an OpenID Connect application see Implementing Authentication.

After you have an application, you need to make sure that the "Allowed grant types" include "Refresh Token".

How to Use a Refresh Token 

To refresh your access token as well as an ID token, you send a token request with a grant_type of refresh_token. Be sure to include the openid scope when you want to refresh the ID token.

http --form POST https://okta.okta.com/oauth2/default/v1/token \

accept:application/json \

authorization:'Basic MG9hYmg3M...' \

cache-control:no-cache \

content-type:application/x-www-form-urlencoded \

grant_type=refresh_token \

redirect_uri=http://localhost:8080 \

scope=offline_access%20openid \

refresh_token=MIOf-U1zQbyfa3MUfJHhvnUqIut9ClH0xjlDXGJAyqo

If the refresh token is valid, then you get back a new access/refresh token combination:

{

"access_token": "eyJhbGciOiJ[...]K1Sun9bA",

"token_type": "Bearer",

"expires_in": 3600,

"scope": "offline_access%20openid",

"refresh_token": "MIOf-U1zQbyfa3MUfJHhvnUqIut9ClH0xjlDXGJAyqo",

"id_token": "eyJraWQiO[...]hMEJQX6WRQ"

}

If you want more details about this situation, you can click on the link below:

https://developer.okta.com/authentication-guide/tokens/refreshing-tokens/#how-to-use-a-refresh-token

All the best,

Mihail

Go into the authorization server (AS), select Access Policies tab, Add New Access Policy, Add Rule where Access and Refresh tokens TTLs can be configured. As far as I know, there is no association of AS to app or client or group or user in the portal but that the way client can connect to a specific AS is using the AS id, i.e., authorizaionServerId. Once you have an AS configured, use the Authorization Server API to verify its endpoints.