Specified in draft-ietf-oauth-security-topics-13 section 4.12, refresh token rotation is becoming a vital part of using OIDC with SPAs. Auth0 supports it–does KeyCloak?
It should be possible to enable refresh token rotation through the option “Revoke Refresh Token” (please see https://www.keycloak.org/docs/latest/server_admin/#_timeouts).