Auth0-react is not accepting scopes

[omar.muhtaseb]

I’m using auth0-react in my application to authenticate users. I’m trying to get the refresh token, but every time I add the scope, it’s getting overwritten by the default scopes.
Here’s the provider data

        <Auth0Provider
          domain={ENVIRONMENT}
          clientId={ENVIRONMENT}
          authorizationParams={{
            redirect_uri:  CALLBACK_URL,
            audience: ENVIRONMENT,
            scope: 'openid profile email offline_access',
          }}
        >

Here’s the loginWithRedirect

      loginWithRedirect({
        authorizationParams: { scope: 'openid profile email offline_access' },
      }).catch(console.error);

and here is getting access token

        accessToken = await getAccessTokenSilently({
          timeoutInSeconds: 1,
          authorizationParams: { scope: 'openid profile email offline_access' },
        });

Whenever I send the request, it’s always without the offline_access scope.

I also have the refresh token enabled for the app

[tyf]

Hey there @omar.muhtaseb welcome to the community!

Interesting Does setting useRefreshTokens={true} in Auth0Provider cause the offline_access scope to be included?

[omar.muhtaseb]

I added that as well

But it is still the same, this is the getTokenSilently request

[tyf]

Thanks for confirming - Does the API which you are using as audience have the “allow offline access” option toggled?

API Settings

[omar.muhtaseb]

I don’t see this option in my API

[tyf]

Are you by chance using the management API as your audience (https://{your_domain}/api/v2)?

Having trouble enabling Allow Offline Access

Hi! The issue here is that you are using the management API. It is not possible to get refresh tokens for the Management API, so therefore there is no “Offline Access” to enable in the settings. You will instead need to create a new token each time, which can be done programmatically by following the steps here: Get Management API Access Tokens for Production Other APIs have refresh tokens / enable Offline access, but the management API does not because it only support client credentials grant…

[omar.muhtaseb]

Yes, that’s the API I’m using.
Based on what you just shared, do I need to create another API to get a refresh token? I need to implement the offline access in my case.

[tyf]

Thanks for confirming!

@omar.muhtaseb

Based on what you just shared, do I need to create another API to get a refresh token?

Yes, you will need to register an API in Auth0. At that point you will be able to add the offline_access scope and use refresh tokens.