# Blazor App not getting refresh token **URL:** \ **Category:** Get Help\ **Tags:** google-social-connection, connections\ **Created:** [September 4, 2023, 4:42pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350 "2023-09-04T16:42:54Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![chase-cannect](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chase-cannect/32/33365_2.png) [@chase-cannect](https://community.auth0.com/u/chase-cannect)\ **Post date:** [September 4, 2023, 4:42pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/1 "2023-09-04T16:42:54Z")
I’m building a Bazor app and I cannot seem to be able to obtain a Refresh Token. Is there something I’m missing here in order to get this working? Here is my Program.cs ```csharp builder .Services .AddOidcAuthentication(options => { builder.Configuration.Bind("Auth0", options.ProviderOptions); options.UserOptions.RoleClaim = builder.Configuration["Auth0:CustomClaimsSchema"] + "/roles"; options.ProviderOptions.AdditionalProviderParameters.Add("audience", builder.Configuration["Auth0:Audience"]); }) .AddAccountClaimsPrincipalFactory>(); ``` The config ```json "Auth0": { "Authority": "https://--redacted--", "ClientId": "--redacted--", "Audience": "https://--redacted--", "RedirectUri": "https://localhost:5000/auth/login-callback", "CustomClaimsSchema": "https://--redacted--", "DefaultScopes": ["email", "offline_access"], "ResponseType": "id_token token" } ``` My response is as follows ```json { "id_token": "--redacted--", "token_type": "Bearer", "scope": "openid profile email offline_access", "profile": { "https://cannect.app/claims/user_id": "83sPs1siLa", "https://cannect.app/roles": [ "tenant-owner", "system-user" ], "https://cannect.app/tenants": [ { "Gs1CompanyPrefix": "4463756", "TenantId": "kQ0Jev", "TenantName": "cannect", "TenantRole": "tenant-owner" }, { "Gs1CompanyPrefix": "4463756", "TenantId": "kQ0Jev", "TenantName": "cannect", "TenantRole": "tenant-owner" } ], "given_name": "Chase", "family_name": "---", "nickname": "chase.---", "name": "Chase ---", "picture": "https://lh3.googleusercontent.com/a/-redacted-", "locale": "en", "updated_at": "2023-09-04T16:30:44.093Z", "email": "-redacted-", "email_verified": true, "sub": "google-oauth2|-redacted-", "sid": "-redacted-" }, "expires_at": 1693852247 } ``` And I’ve definitely turned on Refresh Tokens in my dashboard ![image](https://global.discourse-cdn.com/auth0/original/3X/1/6/16f7ad8375d3e4683e77df4854fca0345aca671c.png) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 7, 2023, 7:53pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/3 "2023-09-07T19:53:08Z")
Hi @chase-cannect, Welcome back to the Auth0 Community! Can you please confirm you have toggled on the _Allow Offline Access_ setting for your API in the Auth0 Dashboard? The API you are using should correspond with the `audience` parameter you are using in your Blazor app. Thanks! ---
**Author:** ![chase-cannect](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chase-cannect/32/33365_2.png) [@chase-cannect](https://community.auth0.com/u/chase-cannect)\ **Post date:** [September 8, 2023, 3:00pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/4 "2023-09-08T15:00:05Z")
I believe so, the API (Audience) I’m using has the following ![image](https://global.discourse-cdn.com/auth0/original/3X/9/e/9eedff8f1f8f112622b842368697be667d7b5405.png) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 8, 2023, 5:26pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/5 "2023-09-08T17:26:40Z")
Thank you for the additional information. Could you please DM me a HAR file of the transaction? > **[Generate and Analyze HAR Files](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files)** > > Learn how to troubleshoot with HAR files and steps to generate a HAR file. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 12, 2023, 1:58pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/6 "2023-09-12T13:58:50Z")
Thanks for the HAR. I think this may be the issue: [Implicit Flow with OIDC](https://auth0.com/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-implicit-flow) ---
**Author:** ![chase-cannect](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chase-cannect/32/33365_2.png) [@chase-cannect](https://community.auth0.com/u/chase-cannect)\ **Post date:** [September 12, 2023, 2:09pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/7 "2023-09-12T14:09:38Z")
Thank you for the response. I’m not entirely sure where to start to change over, what am I missing? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 12, 2023, 2:46pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/8 "2023-09-12T14:46:33Z")
Refresh tokens aren’t allowed with the Implicit Flow. You should upgrade to the code flow to request a refresh token. Here’s a resource that may be helpful: > **[How to Secure Blazor WASM Applications with Auth0](https://auth0.com/blog/securing-blazor-webassembly-apps/#Adding-Support-for-Authentication)** > > Learn how to secure Blazor WebAssembly applications with Auth0. ---
**Author:** ![chase-cannect](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chase-cannect/32/33365_2.png) [@chase-cannect](https://community.auth0.com/u/chase-cannect)\ **Post date:** [September 12, 2023, 3:10pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/9 "2023-09-12T15:10:24Z")
So, are you saying that I can no longer use my custom Flow? ![image](https://global.discourse-cdn.com/auth0/original/3X/3/f/3f7c46a06d05e6e39f29c6d4299a222cd790b7ac.png) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 13, 2023, 12:59pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/10 "2023-09-13T12:59:06Z")
You can still use your custom Actions, they should not be effected. It appears you are still using the _Implicit Flow_, which is a legacy authentication protocol flow that is considered less-secure. It doesn’t allow for refresh tokens as a result, and I suggest updating your app to the _Auth Code Flow_. Does that help clarify? ---
**Author:** ![chase-cannect](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chase-cannect/32/33365_2.png) [@chase-cannect](https://community.auth0.com/u/chase-cannect)\ **Post date:** [September 13, 2023, 1:26pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/11 "2023-09-13T13:26:29Z")
So I _thought_ I had followed all of this in detail, however after reading [this article](https://auth0.com/blog/securing-blazor-webassembly-apps/), I discovered one single line was missing ```csharp options.ProviderOptions.ResponseType = "code"; ``` After adding this line, I was able to see a `refresh_token` in the payload ![image](https://global.discourse-cdn.com/auth0/original/3X/a/b/ab853ebbf53d96193e863ede1d36d1bdc7da0b6e.png) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 13, 2023, 1:29pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/12 "2023-09-13T13:29:02Z")
That should do it! I’m glad switching to the Auth Code Flow was that simple (I thought it would be a bit more complex, to be honest). Thanks for posting your solution too! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 27, 2023, 1:29pm UTC](https://community.auth0.com/t/blazor-app-not-getting-refresh-token/115350/13 "2023-09-27T13:29:07Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.