You could rotate the key (make available the new secret) before expiring the old. During that time (which can be even a few hours) you typically reload your app

You could rotate the key (make available the new secret) before expiring the old. During that time (which can be even a few hours) you typically reload your application to use the new credential. If you are able to change your application's code, you could integrate with vault's API directly which is the most clean solution. If you are unable, you can use [consul-template](https://github.com/hashicorp/consul-template https://github.com/hashicorp/consul-template) or [envconsul](https://github.com/hashicorp/envconsul https://github.com/hashicorp/envconsul) to securely introduce your secret which would entail reloading/restarting your application.