diff --git a/internal/models/oauth_scope.go b/internal/models/oauth_scope.go
index 13d7148ef..c3b5a21dc 100644
--- a/internal/models/oauth_scope.go
+++ b/internal/models/oauth_scope.go
@@ -4,10 +4,11 @@ import "strings"
 
 // OAuth/OIDC scope constants
 const (
-	ScopeOpenID  = "openid"
-	ScopeEmail   = "email"
-	ScopeProfile = "profile"
-	ScopePhone   = "phone"
+	ScopeOpenID        = "openid"
+	ScopeEmail         = "email"
+	ScopeProfile       = "profile"
+	ScopePhone         = "phone"
+	ScopeOfflineAccess = "offline_access"
 )
 
 // SupportedOAuthScopes defines all OAuth/OIDC scopes supported by the server
@@ -16,6 +17,7 @@ var SupportedOAuthScopes = []string{
 	ScopeProfile,
 	ScopeEmail,
 	ScopePhone,
+	ScopeOfflineAccess,
 }
 
 // IsSupportedScope checks if a scope is in the supported scopes list
diff --git a/internal/models/oauth_scope_test.go b/internal/models/oauth_scope_test.go
index 0d991140b..99677fbc0 100644
--- a/internal/models/oauth_scope_test.go
+++ b/internal/models/oauth_scope_test.go
@@ -224,6 +224,11 @@ func TestIsSupportedScope(t *testing.T) {
 			scope:    ScopePhone,
 			expected: true,
 		},
+		{
+			name:     "offline_access scope is supported",
+			scope:    ScopeOfflineAccess,
+			expected: true,
+		},
 		{
 			name:     "unsupported scope address",
 			scope:    "address",