I am using touchRequiredSession with refresh tokens and custom headers. I am noticing that the refresh-token is rotated when the access token is expired and the refresh token is not. It is my understanding that using touch should not result in a new refresh token, only a new access token. I verified that the refresh token was being rotated with an extended expiry in the data store.

I could be wrong, but it seems like requiredSession(), which is called by touch, always does the rotation when expired. https://github.com/softwaremill/akka-http-session/blob/master/core/src/main/scala/com/softwaremill/session/SessionDirectives.scala#L81