The “short” access token sounds like it might be an opaque token, which is what you will get back from Auth0 if you do not specify an audience string in your request.
ID and refresh tokens are returned only if you request the associated scopes, openid and offline_access respectively.