For AWS Cognito's Token endpoint? Where is that documented? I'm also not seeing that behavior, as I don't have that in my scope and I do get a refresh token if I do the CODE flow.

I'm referring to the openid standard I guess[1], it looks like AWS Cognito does something different (they don't support offline_access, but they always issue a refresh_token from what I'm reading).

1 - https://openid.net/specs/openid-connect-core-1_0.html#Offlin...

Yeah, if you do a CODE flow, you get three tokens. Implicit is only access.

They at least have decent support to guard api access using these.