# Missing API method to retrieve RefreshToken from OIDC **URL:** \ **Category:** General\ **Tags:** pega-platform, senior-system-architect, case-management\ **Created:** [July 19, 2026, 6:14am UTC](https://forums.pega.com/t/missing-api-method-to-retrieve-refreshtoken-from-oidc/12791 "2026-07-19T06:14:18Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![SmitaS17212643](https://avatars.discourse-cdn.com/v4/letter/s/858c86/32.png) [@SmitaS17212643](https://forums.pega.com/u/SmitaS17212643)\ **Post date:** [July 19, 2026, 6:14am UTC](https://forums.pega.com/t/missing-api-method-to-retrieve-refreshtoken-from-oidc/12791/1 "2026-07-19T06:14:18Z")
We are using OpenID Connect (OIDC) via an **Authentication Service** integrated with **Okta** as our Identity Provider (IdP). - The **Access Token** generated by Okta has a specific validity window. - If a user keeps an old Pega session open past this window, subsequent calls made from Pega to external APIs fail because the current Access Token has expired. To resolve this, we are trying to implement a token refresh strategy within our **Post-Authentication Activity** using Pega Engine APIs. While we are successfully able to initialize `com.pega.pegarules.pub.connect.oauth2.OAuth2Client` and retrieve the access token via `oauth2Client.getAccessToken()`, But compiling our custom Java step fails because **no public Java method exists to retrieve the Refresh Token**. ---
**Author:** ![bajrang](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bajrang](https://forums.pega.com/u/bajrang)\ **Post date:** [July 19, 2026, 8:08am UTC](https://forums.pega.com/t/missing-api-method-to-retrieve-refreshtoken-from-oidc/12791/2 "2026-07-19T08:08:55Z")
Try to use OOTB **pxRevokeToken activity** with Authentication profile as parameter in post authentication activity. In new API call , fresh token can be generated. ---
**Author:** ![Sairohith](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/sairohith/32/23362_2.png) [@Sairohith](https://forums.pega.com/u/Sairohith)\ **Post date:** [July 19, 2026, 6:16pm UTC](https://forums.pega.com/t/missing-api-method-to-retrieve-refreshtoken-from-oidc/12791/3 "2026-07-19T18:16:27Z")
To resolve the compilation failure and handle the expired token, you must avoid manual Java steps to extract the refresh token, as Pega deliberately encrypts and hides it from public APIs for security purposes. Instead, the solution is to configure an **OAuth 2.0 Authentication Profile** directly on your Connect-REST rule using the **Authorization Code** grant type and enable the **“Use refresh token if available”** checkbox. This allows the Pega Platform to automatically intercept expired access tokens at runtime, fetch the corresponding encrypted refresh token from the internal database (`pr_data_token`), and silently request a fresh access token from Okta without requiring any custom Java code. ---
**Author:** ![Sudhakar\_Tentu](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/sudhakar_tentu/32/6225_2.png) [@Sudhakar\_Tentu](https://forums.pega.com/u/Sudhakar_Tentu)\ **Post date:** [July 20, 2026, 9:50am UTC](https://forums.pega.com/t/missing-api-method-to-retrieve-refreshtoken-from-oidc/12791/4 "2026-07-20T09:50:29Z")
Hi Smita , When a user logs in to the application using OIDC, the Identity Provider (IdP) issues an ID Token, Access Token, and optionally a Refresh Token. Pega creates a unique cache key based on the combination of Client ID , Scopes , User and Grant Type and stores the issued tokens against that key. Later, when an outbound call is made using the same Client ID and Scopes, Pega first looks up the cache (or database) using the generated key. If a matching entry is found, Pega fetches the associated access token and - If the access token is still valid, it is reused for the outbound call. - If the access token has expired, Pega checks for a valid refresh token and uses it to obtain a new access token from the IdP. **Important Note :** To enable automatic token renewal, the “Use refresh token if available” option must be enabled in the Authentication Profile Make sure the order of scopes provided must match between Authentication service and Authentication Profile . This entire process is handled automatically by Pega behind the scenes and does not require any custom implementation. ---
**Author:** ![BrahmeshTech](https://avatars.discourse-cdn.com/v4/letter/b/13edae/32.png) [@BrahmeshTech](https://forums.pega.com/u/BrahmeshTech)\ **Post date:** [September 1, 2026, 7:21am UTC](https://forums.pega.com/t/missing-api-method-to-retrieve-refreshtoken-from-oidc/12791/5 "2026-09-01T07:21:49Z")
We are implementing OIDC and need to use the **OIDC access token for downstream API calls**. Could you clarify which Auth Profile approach is recommended? **Option 1:** Authorization Code + Refresh Token **Option 2:** JWT Bearer - JWT Assertion Source: _Use token from active SSO session_ For the JWT Bearer option: - Which token does Pega use as the JWT assertion—the **ID token or access token** that generated during OIDC authentication?