SecureCredentialsManager throws unexpected exception

And further investigation, WebAuthProvider needs to be called with scope offline_access to get the refresh token. Problem solved.