# Oauth/token not returning refresh token **URL:** \ **Category:** Get Help\ **Tags:** refresh-tokens\ **Created:** [February 18, 2021, 1:33pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093 "2021-02-18T13:33:56Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![kruegeba](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kruegeba/32/13314_2.png) [@kruegeba](https://community.auth0.com/u/kruegeba)\ **Post date:** [February 18, 2021, 1:33pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/1 "2021-02-18T13:33:56Z")
I have a 3rd Party application (web application) set up and am currently unable to get the refresh token in my /token call after completing an Authorization Code Flow. I’m kicking it off correctly I believe (indicating offline\_access in scopes): [https://my-tenet/authorize?response\_type=code&client\_id=my-client-id&redirect\_uri=http://localhost:4200/dashboard&audience=my-audience&scope=offline\_access](https://my-tenet/authorize?response_type=code&client_id=my-client-id&redirect_uri=http://localhost:4200/dashboard&audience=my-audience&scope=offline_access) read:app create:app&state=STATE&prompt=login Then when requesting oauth/token on return: [https://my-tenet/oauth/token?grant\_type=authorization\_code&client\_id=my-client-id&client\_secret=my-client-secret&code=returned-code&redirect\_uri=http://localhost:4200/dashboard](https://my-tenet/oauth/token?grant_type=authorization_code&client_id=my-client-id&client_secret=my-client-secret&code=returned-code&redirect_uri=http://localhost:4200/dashboard) I still only get access\_token: {“access\_token”:“eyJhbGci…”,“scope”:“create:app read:app offline\_access”,“expires\_in”:2592000,“token\_type”:“Bearer”} My 3rd Party application has the Refresh Token grant and is OIDC Conforment turned on. The API it is accessing as the audience does have Allow Offline Access turned on as well. I also have a rule set up, but all it’s doing is adding custom claims on the access\_token so I think I’m safe there. Anyone have any other leads I could look into? ---
**Author:** ![gladysjones197394](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gladysjones197394/32/13570_2.png) [@gladysjones197394](https://community.auth0.com/u/gladysjones197394)\ **Post date:** [February 19, 2021, 11:25am UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/3 "2021-02-19T11:25:21Z")
> [@kruegeba](#): > > I have a 3rd Party application (web application) set up and am currently unable to get the refresh token in my /token call after completing an Authorization Code Flow. > > I’m kicking it off correctly I believe (indicating offline\_access in scopes): > > [https://my-tenet/authorize?response\_type=code&client\_id=my-client-id&redirect\_uri=http://localhost:4200/dashboard&audience=my-audience&scope=offline\_access](https://my-tenet/authorize?response_type=code&client_id=my-client-id&redirect_uri=http://localhost:4200/dashboard&audience=my-audience&scope=offline_access) read:app create:app&state=STATE&prompt=login > > Then when requesting oauth/token on return: > > [https://my-tenet/oauth/token?grant\_type=authorization\_code&client\_id=my-client-id&client\_secret=my-client-secret&code=returned-code&redirect\_uri=http://localhost:4200/dashboard](https://my-tenet/oauth/token?grant_type=authorization_code&client_id=my-client-id&client_secret=my-client-secret&code=returned-code&redirect_uri=http://localhost:4200/dashboard) > > I still only get access\_token[:](https://www.epayitonline.us/) > > {“access\_token”:“eyJhbGci…”,“scope”:“create:app read:app offline\_access”,“expires\_in”:2592000,“token\_type”:“Bearer”} > > My 3rd Party application has the Refresh Token grant and is OIDC Conforment turned on. The API it is accessing as the audience does have Allow Offline Access turned on as well. I also have a rule set up, but all it’s doing is adding custom claims on the access\_token so I think I’m safe there. > > Anyone have any other leads I could look into? If you do not get back a new refresh token , then it means your existing refresh token will continue to work when the new access token expires. ---
**Author:** ![kruegeba](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kruegeba/32/13314_2.png) [@kruegeba](https://community.auth0.com/u/kruegeba)\ **Post date:** [February 19, 2021, 12:34pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/4 "2021-02-19T12:34:29Z")
I’ve never received a refresh token in the first place or have ever seen a “refresh\_token” property in my /oauth/token response… ---
**Author:** ![kruegeba](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kruegeba/32/13314_2.png) [@kruegeba](https://community.auth0.com/u/kruegeba)\ **Post date:** [February 19, 2021, 9:17pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/5 "2021-02-19T21:17:37Z")
Just pinging for visibility in case anyone else has any ideas? Otherwise I’ll have to continue playing with settings… ---
**Author:** ![tkrueger123](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tkrueger123/32/13728_2.png) [@tkrueger123](https://community.auth0.com/u/tkrueger123)\ **Post date:** [August 4, 2021, 3:27am UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/6 "2021-08-04T03:27:55Z")
There are two things you need to do from what I know. 1. Include scope “offline\_access” 2. Enable offline access on your api in the Auth0 Dashboard. Check out this doc: [Refresh Tokens](https://auth0.com/docs/tokens/refresh-tokens) Good Luck! Tom ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [August 4, 2021, 12:15pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/7 "2021-08-04T12:15:47Z")
Thanks for sharing it with the rest of community! ---
**Author:** ![Idan-Berkovich](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/idan-berkovich/32/39828_2.png) [@Idan-Berkovich](https://community.auth0.com/u/Idan-Berkovich)\ **Post date:** [October 5, 2022, 1:24pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/8 "2022-10-05T13:24:29Z")
For me it only worked after toggling on `Refresh Token Rotation` in the application settings. ---
**Author:** ![d4fzu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/d4fzu/32/43102_2.png) [@d4fzu](https://community.auth0.com/u/d4fzu)\ **Post date:** [January 25, 2023, 6:56am UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/9 "2023-01-25T06:56:23Z")
Doesn’t work for me either, even after enabling `Refresh Token Rotation`. I simply never see a `refresh_token` alongside the `access_token`. I have the `offline_access` scope set and I have the `Refresh Token` Grant Type enabled. ---
**Author:** ![kousha.talebian](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kousha.talebian/32/49897_2.png) [@kousha.talebian](https://community.auth0.com/u/kousha.talebian)\ **Post date:** [August 14, 2023, 9:23pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/10 "2023-08-14T21:23:22Z")
You need to set the scope to `offline_access` when authorizing to get a refresh token. See [Get Refresh Tokens](https://auth0.com/docs/secure/tokens/refresh-tokens/get-refresh-tokens) for more information ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [August 14, 2023, 9:43pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/11 "2023-08-14T21:43:35Z")
For future reference: It also depends on the SDK being using to initiate the authorize request. For example, in [auth0-react](https://github.com/auth0/auth0-react) there’s an `authorizationParams` property of `useRefreshTokens` which defaults to `false`: > **[Auth0ProviderOptions | @auth0/auth0-react](https://auth0.github.io/auth0-react/interfaces/Auth0ProviderOptions.html#useRefreshTokens)** > > Documentation for @auth0/auth0-react ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [August 29, 2023, 9:44pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093/12 "2023-08-29T21:44:10Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.