We have multiple products on different domains and we created centralised login system where in background API call goes to central login system and get access token using laravel passport. now we want to create refresh token but in laravel passport only password grant allow refresh token but it will now deprecated and using Authorisation Code we don’t want to redirect user to different website. if user login to any product user can access other products without login to centralise system from UI.

I tried custom grant and other hacks to create refresh token from passport but looks like they are very old solutions and not working with latest laravel 10 and up versions. so I want silent authentication in background using APIs without redirecting user get authorisation code.