PKCE refresh token storage

[Vitorgus]

I'm currently building a SPA that communicates with the Spofity API using the Authorization Code with PKCE Flow.

How do I safely store the refresh token so the user won't need to grant authorization everytime it uses the application? My worriy is that if I use the browser's local storage, a malicious third party might manage to get access to the refresh token, and be able to generate an access token form it.