Id token and refresh token from in react app

[stephanie.chamblee]

Hi @praskatti,

The React SDK stores the tokens in app memory by default. You can instead use local storage by adding cacheLocation="localstorage" to your Auth0Provider component, but there are security considerations with that method which you can read about here:

Token Storage

The Refresh Token will be returned to your app if:

1. You API is configured to allow offline access: Register APIs
2. The Auth0Provider contains the offline_access scope: scope="offline_access"
3. The app is configured to allow refresh token rotation

The SDK will generate a nonce and send it with the oauth/authorize request when you call loginWithRedirect():