# Is it possible to use Auth0 for long-term web authentication?

**URL:** <https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550>\
**Category:** Get Help\
**Created:** [January 25, 2019, 2:25pm UTC](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550 "2019-01-25T14:25:46Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![pimterry](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pimterry/32/10679_2.png) [@pimterry](https://community.auth0.com/u/pimterry)\
**Post date:** [January 25, 2019, 3:23pm UTC](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550/2 "2019-01-25T15:23:03Z")

</div>

Found it! You can indeed work around this, and the result actually works very nicely:

- Disable ‘OIDC Conformant’ in ‘Advanced Options’ → ‘OAuth’ for your application
- Authenticate with a `scope` parameter including `offline_access` in the UI, e.g. with Lock v11:

```auto
const lock = new Auth0Lock('...', '...', {
    ...
    auth: {
        params: { scope: 'openid email offline_access' },
    }
}

```

After authenticating, the auth result in `authenticated` events from the lock now includes `refreshToken`, which you should be able to use with [Refresh Tokens](https://auth0.com/docs/tokens/refresh-token/current#use-a-refresh-token) to refresh. In my case, I’m using `auth0-js` and doing:

```auto
const client = new Auth0.Authentication({
    clientID: '...',
    domain: '...'
});
client.oauthToken({
    refreshToken: authResult.refreshToken, // from the authentication event
    grantType: 'refresh_token'
}, (error, result) => {
    result.accessToken // Fresh refreshed access token
});

```

I’m sure this is discouraged, and I do agree that if you’re protecting sensitive data or operations, you should ensure users reauthenticate frequently. I definitely don’t agree that every application is doing that though, and being able to opt-out of that and take responsibility for session expiry myself is very useful to me.

The refresh step here is more or less verbatim from the latest react native SDK, so should keep working for as long that’s supported. The initial login step to get that refresh token is that part that depends on non-OIDC behaviour (specifically: refresh tokens must be allowed for implicit grants), so might stop working if that is removed in future. It doesn’t sound like that’s happening any time soon though, and the current docs say this’ll be available ‘until further notice’. I’d like to find an alternative that doesn’t require this, but it seems that’s not currently available.

It’d be interesting to hear thoughts from anybody at Auth0 if there’s any more specific info on when that might happen, or whether there’s any other major caveats to the above.

---

_[View the full topic](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550)._