public String getClientRotatedSecret(KeycloakSession session) {
        return getClientRotatedSecret(session, false);
    }

    /**
     * Returns the rotated client secret value, optionally resolving vault expressions.
     * Vault resolution should only be enabled for authentication validation, never for
     * returning values through the Admin API to avoid leaking sensitive vault-backed values.
     * Use {@link #hasRotatedSecret()} to check whether a rotated secret is effectively present before calling this method.
     *
     * @param session the keycloak session
     * @param resolveVault if {@code true}, vault expressions like {@code ${vault.key}} are resolved to their actual values;
     *                     if {@code false}, the raw stored value (potentially a vault placeholder) is returned
     */
    public String getClientRotatedSecret(KeycloakSession session, boolean resolveVault) {
        String secret = getAttribute(CLIENT_ROTATED_SECRET);
        if (resolveVault && session != null) {
            return session.vault().getStringSecret(secret).get().orElse(secret);
        }
        return secret;
    }

        return MessageDigest.isEqual(secret.getBytes(), getClientRotatedSecret(session, true).getBytes());

            realm.clients(ClientBuilder.create("myclient-with-rotated-vault-secret")
                    .publicClient(false)
                    .directAccessGrantsEnabled(true)
                    .secret("some-primary-secret")
                    .attribute(ClientSecretConstants.CLIENT_ROTATED_SECRET, "${vault.rotated_secret}")
                    .attribute(ClientSecretConstants.CLIENT_ROTATED_SECRET_CREATION_TIME, String.valueOf(System.currentTimeMillis() / 1000))
                    .attribute(ClientSecretConstants.CLIENT_ROTATED_SECRET_EXPIRATION_TIME, String.valueOf(System.currentTimeMillis() / 1000 + 86400)));

rotatedsecret