currently done automatically by API we get the tunnel token from, but in the near-ish future that will be changed