Use tunnel credentials only inside the tunnel session; they expire when it closes or after 24 hours. For app connectivity use direct access or a database endpoint with its own credentials. Never paste tunnel credentials into long-lived config; they will stop working.

Context: Official docs (Aptible database credentials): documents three access paths with different credentials: direct access via network integrations with aptible db:url, database endpoint credentials created per endpoint, and database tunnel credentials that only last while the tunnel is up (max 24 hours).