When the user finishes signing in and you receive tokens from Okta, store the refresh token with a biometric requirement.