title: IdentityServer4 refresh token invalid grant
body: <p>I'm having some issues on requesting new refresh tokens in IdentityServer4. Sometime after authentication, I get an Unauthorized response from my API, ok, but when I try to request a new refresh token, I get an invalid_grant from the server. I made sure that I set offline_access, but am still encountering the problem. Here is my code:</p>
  <p>My Client in Server Config.cs</p>
  <pre><code>new Client
              {
                  ClientId = &quot;myclientId&quot;,
                  ClientName = &quot;MyClient&quot;,
                  AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
  
                  RequireConsent = false,
  
                  ClientSecrets =
                  {
                      new Secret(&quot;mySecret&quot;.Sha256())
                  },
  
                  RedirectUris = { &quot;http://localhost:5002/signin-oidc&quot; },
                  PostLogoutRedirectUris = { &quot;http://localhost:5002/signout-callback-oidc&quot; },
  
                  AllowOfflineAccess = true,
  
                  UpdateAccessTokenClaimsOnRefresh = true,
  
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      IdentityServerConstants.StandardScopes.OfflineAccess,
                      ...
                  }
              }
  </code></pre>
  <p>My Startup.cs from MVCclient</p>
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationScheme = &quot;Cookies&quot;,
              AccessDeniedPath = &quot;/Home/Error403&quot;
          });
  
          app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
          {
              AuthenticationScheme = &quot;oidc&quot;,
              SignInScheme = &quot;Cookies&quot;,
  
              Authority = Configuration[&quot;Identity.Url&quot;],
              RequireHttpsMetadata = false,
  
              ClientId = Configuration[&quot;ClientId&quot;],
              ClientSecret = Configuration[&quot;ClientSecret&quot;],
  
              ResponseType = &quot;code id_token&quot;,
  
              Scope = { &quot;openid profile offline_access&quot; },
  
              GetClaimsFromUserInfoEndpoint = true,
              SaveTokens = true,
  
          });
  </code></pre>
  <p>Here I'm getting invalid_grant</p>
  <pre><code>var disco = await DiscoveryClient.GetAsync(Configuration[&quot;Identity.Url&quot;]);
          if (disco.IsError) throw new Exception(disco.Error);
  
          var tokenClient = new TokenClient(disco.TokenEndpoint, Configuration[&quot;ClientId&quot;],
              Configuration[&quot;ClientSecret&quot;]);
          var rt = await HttpContext.Authentication.GetTokenAsync(&quot;refresh_token&quot;);
          var tokenResult = await tokenClient.RequestRefreshTokenAsync(rt);
  </code></pre>
  <p>tokenResult is assigned invalid_grant.
  Am I missing something?</p>