So typically I see refresh tokens used with more secure methods of authentication with interactive flows such as Hybrid or Interactive, but I was curious if this is something that could also be enabled for the Password grant type that is being used for the Postman API client?

I have gone into the configuration for Sitecore XC Identity Provider and changed the configuration to AllowOfflineAccess: true as well as adding offline_access as an allowed Scope, and after restarting IIS, I'm still not able to add the scope for `offline_access to this specific grant type. Has anyone gotten this to work, and how were you able to achieve this?

I'm getting back the following error in postman:

    "error": "invalid_scope"

1 Answer 1


For 9.0.2 you have to do some code changes in Sitecore Identity Service then it will work.

  1. Open Sitecore Identity Server Solution. (you can find the SDK in XC installation package)
  2. Open AppSettings.cs and add AllowOfflineAccess property in Client class.
  3. Open Clients.cs in Configuration folder and update the Get method to pass AllowOfflineAccess property value to IdentityServer4 Client class.
  4. Make changes in wwwroot\appsettings.json file as you already mentioned above.
  5. Build and deploy Sitecore Identity Service solution.

Once above is done you can try GetToken call again from Postman, you should get a "refresh_token" in response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.