I have a spa that allows uses to access the system using the auth0 and lock libraries.
I am unable to retrieve the refresh token nor the access token to allow me to work with the saleforce api to do offline operations.
The process to obtain identity provider (IdP) access tokens that are generated as a by-product of end-user authentication through an external IdP is documented here. The process requires a component in your system that can act as a confidential client and as such cannot be used directly by SPA’s as those are considered public clients.
In addition, obtaining refresh tokens is something that is not available for all external IdP as the refresh token is only stored for a subset of the available providers; the linked documentation above goes over that subset and it seems Salesforce is not included in the supported list.
got it - thanks.