Rotating OAuth client secrets without downtime using Client App SDK

We need to rotate client secrets for our custom desktop app. The docs say we can have two active secrets. How do we handle the switch in the GenesysCloud.ClientAppSdk? If I create a new token with the new secret, does the old token expire immediately? Or do I need to handle a 401 and retry? Here is the config I am using: { clientId: ‘abc’, clientSecret: ‘old_secret’ }. What is the best way to code this rotation so agents don’t see a login error during the switch?