Hey there @RaptorX
I suspect this is due to the lack of an audience param in your passwordlessLogin function - You’ll also want to make sure that the API identifier you pass as the audience has Allow Offline Access toggled on as well:
passwordlessLogin
Allow Offline Access