# Auth0 management API issuing refresh tokens

**URL:** <https://community.auth0.com/t/auth0-management-api-issuing-refresh-tokens/187035>\
**Category:** Get Help\
**Tags:** logs, management-api\
**Created:** [May 21, 2025, 4:35pm UTC](https://community.auth0.com/t/auth0-management-api-issuing-refresh-tokens/187035 "2025-05-21T16:35:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bryceb](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/bryceb/32/71291_2.png) [@bryceb](https://community.auth0.com/u/bryceb)\
**Post date:** [May 21, 2025, 4:35pm UTC](https://community.auth0.com/t/auth0-management-api-issuing-refresh-tokens/187035/1 "2025-05-21T16:35:16Z")

</div>

Hello.

It has been reported multiple times on this forum that the auth0 management API cannot issue refresh tokens and offline access cannot be enabled for it.

> [@Having trouble enabling Allow Offline Access](https://community.auth0.com/t/having-trouble-enabling-allow-offline-access/30803/4):
>
> Thank you for your answer. It totally makes sense.

> [@Why no "Allow Offline Access" option in Default API and Invalid Token for Custom Api?](https://community.auth0.com/t/why-no-allow-offline-access-option-in-default-api-and-invalid-token-for-custom-api/73316):
>
> I have two apis In first one I can’t find “Allow Offline Access” option. My question is why? In second api I have this option and it is enabled I sending POST to [https://preciselab.eu.auth0.com/oauth/token](https://preciselab.eu.auth0.com/oauth/token) With default api as audience Then I can see { "access\_token": "\_\_\_", "scope": "read:client\_grants create:client\_grants delete:client\_grants update:client\_grants read:users update:users delete:us…

> [@Having trouble enabling Allow Offline Access](https://community.auth0.com/t/having-trouble-enabling-allow-offline-access/30803):
>
> Hi I am trying to enable Allow Offline Access in order to start configuring refresh token however when I log into my dashboard \> APIs \> settings I don’t see an option to enable that. Any help is much appreciated .

And so on.

However, we have observed the following in our logs:

```auto

{
  "date": "2025-05-20T16:06:44.588Z",
  "type": "sertft",
  "description": "Successful Refresh Token exchange",
  "connection": "Username-Password-Authentication",
  "connection_id": "con_t9CTvZ26ABENH2lf",
  "client_id": "our client id",
  "client_name": "ourclient",
  "ip": "...",
  "client_ip": "...",
  "user_agent": "Mobile Safari UI/WKWebView 0.0.0 / iOS 16.7.11",
  "details": {
    "tokenCounter": 1,
    "familyId": "b880pNBtVUw-oebW2pv3dQ",
    "actions": {
      "executions": [
        "ZTK7_KS3Iq9E9YvQlKSeHZQhMjAyNTA1MjBjG4WUX1FCn7WMJYNMeSL8"
      ]
    }
  },
  "user_id": "...",
  "user_name": "...",
  "audience": "https://ourtenant.auth0.com/api/v2/",
  "scope": "openid profile email offline_access",
  "auth0_client": {
    "name": "@auth0/auth0-angular",
    "version": "2.2.3",
    "env": {
      "angular/core": "15.2.10"
    }
  },
  "$event_schema": {
    "version": "1.0.0"
  },
  "log_id": "90020250520160644605136000000000000001223372132150939317",
  "tenant_name": "ourtenant",
  "_id": "90020250520160644605136000000000000001223372132150939317",
  "isMobile": true,
  "id": "90020250520160644605136000000000000001223372132150939317"
}

```

And we aren’t sure how this is possible. Any insight you can offer is much appreciated.

---

<div class="post-metadata">

**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\
**Post date:** [May 30, 2025, 8:32pm UTC](https://community.auth0.com/t/auth0-management-api-issuing-refresh-tokens/187035/3 "2025-05-30T20:32:44Z")

</div>

Hi @bryceb

Thank you for reaching out to us and for providing the details!

Please allow us some time to look into the matter and we will be back as soon as possible with more information.

Best regards,  
Gerald

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [June 3, 2025, 4:25pm UTC](https://community.auth0.com/t/auth0-management-api-issuing-refresh-tokens/187035/4 "2025-06-03T16:25:13Z")

</div>

Hi @bryceb

I am sorry about the delayed response to your inquiry!

From what I understand in the log you have provided, it appears that your application seems to be the one providing the refresh token to the user. As mentioned in the above posts, the mentioned options are not available for the default API created by the Dashboard.

These options are only available for an API you would register within the dashboard. As mentioned there:

> If this setting is enabled, Auth0 will allow applications to ask for Refresh Tokens for this API.

For the Management API, there is a single token which is exchanged with the application which can expire.

If you have any other questions, let me know!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 17, 2025, 4:25pm UTC](https://community.auth0.com/t/auth0-management-api-issuing-refresh-tokens/187035/5 "2025-06-17T16:25:54Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.