I am able to retrieve rotating refresh token using auth0 SPA SDK - however using non-rotating refresh token I am unable to retrieve on SPA (using PKCE authorization flow). I understand the security risk of making non rotating refresh token available to public client (web browser here for example). …

Hi @jmj , Welcome to the Auth0 Community! It sounds like you should be issuing the user a set of client credentials as a third party application. More info here: First-Party and Third-Party Applications

jmj August 26, 2022, 10:55pm 6

Since you are asking I have other question where I could use your expertise. Username Password connection, organization & signup

Retrieve non rotating refresh token using SPA sdk