How to store oAuth2 token without user pin?

Question

OAuth

Greetings!

There are 2 tokens from oAuth2: access and refresh. You can make AES with a salt in the form of user-pin 4 digits and put it in localStorage / IndexedDB, and then ask the user for a pin as soon as decryption is needed (if there is no decrypted access in memory). But the question is: how to protect the token if there is no pin? Request salt from the server?

Thanks for the advice