Grant type 'refresh_token' not allowed for the client.

Based on the information you provided one possible explanation would be that the client application was not explicitly marked as being a first-party application which was then causing issues with the grant type configuration.

If you haven’t done so already can you ensure that the client application in question is flagged with "is_first_party": true (assuming this is indeed a first-party application). This flag is not surfaced in the Dashboard, but you can update the client application to include it by performing a PATCH client request through the Management API.

If the above does not prove to be the source of the issue please update the question with more information about the configuration of the client application.