From 137757602f0dd6d6063487328251260b34da88e1 Mon Sep 17 00:00:00 2001
From: Fusion <noreply@runfusion.ai>
Date: Mon, 18 May 2026 21:41:13 +0200
Subject: [PATCH] fix: make refresh_token optional in OIDC token exchange

Authentik may not return a refresh_token in the authorization_code
response. Use .get() instead of direct dict access to prevent KeyError.
---
 apps/api/src/auth/oidc.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/api/src/auth/oidc.py b/apps/api/src/auth/oidc.py
index 7d67446..79475f7 100644
--- a/apps/api/src/auth/oidc.py
+++ b/apps/api/src/auth/oidc.py
@@ -47,7 +47,7 @@ async def exchange_code_for_tokens(
     payload = response.json()
     return {
         "access_token": payload["access_token"],
-        "refresh_token": payload["refresh_token"],
+        "refresh_token": payload.get("refresh_token"),
     }