title: Missing refresh_token when using authorization code with PKCE
body: <p>after authorizing the management api using the oauth2 code flow with PKCE the response from <code>POST https://login.tapkey.com/connect/token</code> do not return a refresh token. Am I missing something?</p>
  <p>The redirect for the user goes to <code>https://login.tapkey.com/connect/authorize?client_id=[...]&amp;redirect_uri=[...]&amp;scope=write%3Agrants&amp;response_type=code&amp;state=[...]&amp;code_challenge=[...]&amp;code_challenge_method=S256&quot;</code></p>
  <p>After the callback I'm requesting <code>POST https://login.tapkey.com/connect/token</code> with the following form data:</p>
  <pre><code> [
    &quot;grant_type&quot; =&gt; &quot;authorization_code&quot;
    &quot;client_id&quot; =&gt; &quot;[...]&quot;
    &quot;client_secret&quot; =&gt; null
    &quot;code&quot; =&gt; &quot;[...]&quot;
    &quot;redirect_uri&quot; =&gt; &quot;[...]&quot;
    &quot;code_verifier&quot; =&gt; &quot;[...]&quot;
  ]
  </code></pre>
  <p>The response I get is</p>
  <pre><code>[
    &quot;access_token&quot; =&gt; &quot;[...]&quot;
    &quot;expires_in&quot; =&gt; 3600
    &quot;token_type&quot; =&gt; &quot;Bearer&quot;
    &quot;scope&quot; =&gt; &quot;write:grants&quot;
  ]
  </code></pre>