Zero downtime OAuth secret rotation in Genesys Cloud?

I’m trying to rotate our OAuth client secrets without killing the live integration. The docs suggest creating a new secret and waiting for propagation, but I’m getting 401 Unauthorized errors immediately after the API call to PATCH /api/v2/oauth/clients/{id}. Is there a specific delay I need to code in, or a status check endpoint to verify the new secret is active before switching the app config? Here’s the payload I’m sending.