I’m trying to understand if I can do what I would like to accomplish with Oauth without creating security issues.

I have an iOS app that connects to a 3rd party oauth api currently using PKCE auth. It stores the refresh/access tokens in the keychain and as soon as a refresh happens the old refresh token gets invalidated and the new one gets stored instead. Refresh token rotation only happens for pkce auth, not for standard confidential client auth.

I want to add some serverside capabilities with user accounts for users that opt into a certain feature, where the server would also need to have an active session for that user.

My current setup will not work with this because the 3rd party API invalidates the refresh token once renewed, so that means that the app and server side can’t maintain active sessions.

So I am wondering if there is a that I can securely switch my usage in my app to client credential flow and maybe have a server that steps in the middle and has the client secrets in it, so the app could use client credential flow and then send a refresh token into the server for certain users and the server can have an active session.
is this possible?