Guides

To get a refresh token, you send a request to your Okta Authorization Server.

The only flows that support refresh tokens are the resource owner password flow and the authorization code flow. This means that the following combinations of grant type and scope, when sent to /token endpoint, return a refresh token:

Note: The authorization code flow is unique in that the offline_access scope must be requested as part of the code request to the /authorize endpoint and not the request sent to the /token endpoint.

Get a refresh token with the code flow

In the case of the authorization code flow, you use the authorization server's /authorize endpoint to get an authorization code, specifying an offline_access scope. You then send this code to the /token endpoint to get an access token and a refresh token.

Note: Authorization code with PKCE requests don't return refresh tokens if they are sent from SPAs or other browser-based apps. Instead, you can silently refresh tokens by making a call to the /authorize endpoint.

For more information about this endpoint, see Obtain an authorization grant from a User. For more information about the authorization code flow, see Implementing the authorization code flow.

Get a refresh token with the resource owner password flow

For the resource owner password flow, you use the authorization server's /token endpoint directly.

For more information about this endpoint, see Request a token. For more information about the resource owner password flow, see Implementing the resource owner password flow.

For example, with the password grant type you can include an openid scope alongside the offline_access scope:

POST https://${yourOktaDomain}/oauth2/default/v1/token

grant_type=password
 &redirect_uri=http%3A%2F%2Flocalhost%3A8080
 &username=example%40mailinator.com
 &password=a.gReAt.pasSword
 &scope=openid%20offline_access

You would then get back an ID token alongside your access and refresh tokens. See the Okta OAuth 2.0 reference page.

Get a new access token/ID token silently for your SPA

In a normal Single-Page Application (SPA), it is usually undesirable to redirect the user to a sign-in page during normal navigation. For example, a user could request access to a resource, prompting your SPA to send a request to the Okta /authorize endpoint. Normally, if a user doesn't have a valid session, this request results in a redirection to a sign-in page. To avoid this disruptive redirection, the endpoint allows for a request parameter called prompt. If the value of the prompt parameter is none, this guarantees that the user won't be prompted to sign in, regardless of whether they have an active session. Instead, your application either silently obtains the requested tokens or an OAuth error response. How to act on the error is up to you.

For more information on the /authorize endpoint, see the Authentication Request section of the OIDC Reference.