invalid_request (Parameter redirect_uri does not match code) + openid-client...

Azure AD provides refresh_token even I don't request and permissions does not have offline_acces...