Does a React SPA with `@auth0/auth0-react` automatically configure/handle Authorization Code Flow with PKCE?

In addition, you do need to manually configure your React app to use refresh tokens as this is not enabled by default. If configured correctly, the SDK does handle storing, using and rotating refresh tokens (if enabled).