You can use that in browser application with authorization_code too. That's not a problem. For refresh_token you can't at this point. The offline token itself is special kind of refresh token (It's refresh token which never expires). So if you send refresh request with offline token, you will automatically receive new offline token. Otherwise if you send refresh request with "classic" refresh token, you will receive another classic refresh token. I suggest to look at documentation http://keycloak.github.io/docs/userguide/keycloak-server/html/timeouts.ht... and try the example (referenced from documentation). The example is browser application and it uses authorization_code . Marek On 11/11/15 19:19, robinfernandes . wrote: