diff --git a/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java b/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java
index a4225a5..93b0568 100644
--- a/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java
+++ b/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java
@@ -75,7 +75,11 @@ public class ModelUtils {
     }
 
     public static RefreshToken getRefreshTokenFrom(TokenResponse tokenResponse) throws Exception {
-        return getRefreshTokenFrom(tokenResponse, RefreshToken.class);
+        return getRefreshTokenFrom(tokenResponse.getRefreshToken());
+    }
+
+    public static RefreshToken getRefreshTokenFrom(String base64EncodedJWT) throws Exception {
+        return mapper.readValue(getDecodedPayload(base64EncodedJWT), RefreshToken.class);
     }
 
     private static <T> T getRefreshTokenFrom(TokenResponse tokenResponse, Class<T> clazz) throws Exception {
@@ -124,7 +128,7 @@ public class ModelUtils {
         logger.debug("Client id not provided, using authorized party field (azp)");
         clientId = accessToken.getIssuedFor();
         if (clientId == null) {
-            logger.debug("Issued for field (azp) not present, getting first of the audience field (aud)");
+            logger.warn("Issued for field (azp) not present, getting first of the audience field (aud)");
             clientId = getFirstAudienceNoAccount(accessToken);
         }
         return clientId;