Hi @cthomas,
Welcome to the Auth0 Community!
In order to return a Refresh Token you will need to pass scope:offline_access.
With that said, you should be aware of all of the risks associated with refresh tokens and embedded login if you are taking this approach.