I have a canvas a app that I distribute via a managed package on the AppExchange. The canvas app is configured to post a signed request to my heroku app. I have selected all the oauth scope options:
The issue I am having is when the post is made to my heroku app, there is no sign of a refresh_token in the JSON context.
Here is a screen from the canvas developer docs, showing that there is a refreshToken included in the POST JSON: