The issue was with okta application configuration.
Be sure to specify refresh_token as a data_type value for the grant_type parameter when adding an OAuth client app (opens new window) using the /apps API.
https://developer.okta.com/docs/guides/refresh-tokens/main/
https://backstage.io/docs/auth/okta/provider
Make sure to select refresh_token
in okta application configuration.