Were you ever able to get this sorted? Which SDK are you using? Is there a reason you are using response_type: "id_token"? I’m not sure it really makes sense to return refresh tokens in this scenario as they are used to refresh access tokens - This may be expected behavior.