Password authentication in Expo App

[dan.woda]

I was referred this post for more info on the matter

React-native-auth0 embedded social login not returning refresh token

Hi @mhopey. The react-native-auth0 library implements the code authorization grant with PKCE , which is the appropriate flow for native applications. Your direct usage of the /authorize endpoint with response_type=token is triggering an “implicit flow” like @James.Morrison said, which is the flow used in SPA. The implicit flow, by definition, does not return refresh tokens because SPAs are not suited to keep a refresh token securely. You can leverage react-native-auth0’s authorize method, whic…

I would take a look at the whole topic. Your best compromise might be having the user login through the browser, which sounds like the Oauth Spec recommendation anyway.

I’ll let you know If anyone else has more info,

Dan