Which storage backend are you using for Vault? With MySql you could use scheduled events (no need to run/manage your own process), a created_at column in the Va

Which storage backend are you using for Vault? With MySql you could use scheduled events (no need to run/manage your own process), a created_at column in the Vault table and a scheduled check for created_at+ttl and have the DB to remove the tokens once the lease is expired. Also, if you were to use an etcd backend you could configure it to have it removed once the lease is expired. The only drawback is that the tokens TTL's are global and you can't set per user.