title: Why doesn't AcquireTokenByAuthorizationCode return RefreshToken
body: <p>In this <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-apps#web-apis" rel="nofollow noreferrer">documentation</a> it gives a complete flow for a web application that calls a web API:</p>
  
  <blockquote>
    <ol>
    <li>The web application executes a policy and the user completes the user experience.</li>
    <li>Azure AD B2C returns an (OpenID Connect) id_token and an authorization code to the browser.</li>
    <li>The browser posts the id_token and authorization code to the redirect URI.</li>
    <li>The web server validates the id_token and sets a session cookie.</li>
    <li>The web server asks Azure AD B2C for an access_token by providing it with the authorization code, application client ID, and
    client credentials.</li>
    <li>The access_token and refresh_token are returned to the web server.</li>
    <li>The web API is called with the access_token in an authorization header.</li>
    <li>The web API validates the token.</li>
    <li>Secure data is returned to the web application.</li>
    </ol>
  </blockquote>
  
  <p>Looking at 6. and using the code in the Azure-Samples repository <a href="https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi" rel="nofollow noreferrer">active-directory-b2c-dotnet-webapp-and-webapi
  </a>, I cannot get the line</p>
  
  <pre><code>AuthenticationResult result = await confidentialClient.AcquireTokenByAuthorizationCode(Globals.Scopes, notification.Code).ExecuteAsync();
  </code></pre>
  
  <p>to return a refresh_token. It returns an IdToken and AccessToken but no RefreshToken.
  <a href="https://i.stack.imgur.com/V5Z50.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/V5Z50.png" alt="screenshot of breakpoint result"></a></p>
  
  <p>By using my browser and Postman and following the steps in this <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-oidc#send-authentication-requests" rel="nofollow noreferrer">document</a> with the same B2C tenant and application I <strong>do</strong> get the refresh token as expected.</p>
  
  <p>This <a href="https://stackoverflow.com/questions/45438804/azure-ad-b2c-openid-connect-refresh-token">question</a> is similar to mine and the <a href="http://www.cloudidentity.com/blog/2016/07/25/controlling-a-web-apps-session-duration-2/" rel="nofollow noreferrer">blog post</a> mentioned in one of the answers provides a work around to the symptom of not having a refresh token but my question remains:</p>
  
  <p>How can I get <code>AcquireTokenByAuthorizationCode</code> to return a refresh_token?</p>