init ios token refresh scenario

Author: ksroda-sa

samples/ios/manifest.yaml

@@ -24,3 +24,22 @@ scenarios:
         value: "{{SCOPES}}"
       - label: "Grant"
         value: "Authorization Code + PKCE"
+
+  mobile_token_refresh:
+    app_type: mobile_desktop
+    display_name: "Token Refresh"
+    grant: "Refresh Token"
+    description: "Use refresh tokens to renew access tokens without re-prompting. Requires offline_access. Refresh tokens are stored in iOS Keychain (kSecAttrAccessibleWhenUnlocked)."
+    callout: "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
+    run_command: "open Quickstart.xcodeproj"
+    required_scopes:
+      - offline_access
+    config_rows:
+      - label: "Client ID"
+        value: "{{CLIENT_ID}}"
+      - label: "Issuer URL"
+        value: "{{ISSUER_URL}}"
+      - label: "Redirect URI"
+        value: "{{REDIRECT_URI}}"
+      - label: "Scopes"
+        value: "{{SCOPES}}"

samples/ios/token-refresh/Config.example.xcconfig

@@ -0,0 +1,15 @@
+// Build settings consumed by Info.plist via $(VAR_NAME) macros, then read
+// from Bundle.main at runtime.
+//
+// xcconfig treats `//` as a comment marker, so the issuer URL is split into
+// HOST + PATH and rebuilt in Swift as `https://HOST` (when PATH is empty)
+// or `https://HOST/PATH` (when PATH is set). ISSUER_HOST may include a port.
+//
+// SCOPES MUST include `offline_access` — that's what asks the IdP to issue a
+// refresh token alongside the access token.
+
+CLIENT_ID = your-client-id
+ISSUER_HOST = your-tenant.us.connect.secureauth.com
+ISSUER_PATH = your-workspace
+REDIRECT_SCHEME = com.secureauth.quickstart.ios.refresh
+SCOPES = openid profile email offline_access