Authentication

curl https://api.dualmindlab.tech/api/models \
  -H "Authorization: Bearer $DUALMIND_TOKEN"

{
  "items": [
    {
      "modelId": "c6e0cc03-3b12-41bf-b119-d0d02bec039b",
      "modelName": "llama-3.3-70b-versatile",
      "displayName": "Llama 3.3 70B Versatile",
      "providerName": "groq",
      "isFree": true,
      "status": "active"
    }
  ]
}

HTTP/2 401
www-authenticate: Bearer error="invalid_token", error_description="The token expired"

curl https://api.dualmindlab.tech/api/models \
  -H "Authorization: Bearer $DUALMIND_TOKEN"

{
  "items": [
    {
      "modelId": "c6e0cc03-3b12-41bf-b119-d0d02bec039b",
      "modelName": "llama-3.3-70b-versatile",
      "displayName": "Llama 3.3 70B Versatile",
      "providerName": "groq",
      "isFree": true,
      "status": "active"
    }
  ]
}

HTTP/2 401
www-authenticate: Bearer error="invalid_token", error_description="The token expired"

The API uses the same sign-in as the Arena. When you sign in, Supabase Auth issues a short-lived access token (a JWT). Send it as a Bearer token:

Authorization: Bearer <access token>

curl https://api.dualmindlab.tech/api/models \
  -H "Authorization: Bearer $DUALMIND_TOKEN"

{
  "items": [
    {
      "modelId": "c6e0cc03-3b12-41bf-b119-d0d02bec039b",
      "modelName": "llama-3.3-70b-versatile",
      "displayName": "Llama 3.3 70B Versatile",
      "providerName": "groq",
      "isFree": true,
      "status": "active"
    }
  ]
}

HTTP/2 401
www-authenticate: Bearer error="invalid_token", error_description="The token expired"

Which endpoints need a token

Needs a token	No token needed
Battles and chat (`/api/arena/dualchat`, `/chat`, `/chat/stream`)	Leaderboard (`GET /api/arena/model-stats`)
Voting (`POST /api/arena/model-vote`)	Health (`GET /health`)
Models (`GET /api/models`)	Feature flags (`GET /api/settings/feature-flag/{key}`)
Your threads (list, create, rename, share, delete)	Shared threads (`public` or `unlisted`)

Get your token

Open arena.dualmindlab.tech and sign in.

Open the browser console

Press F12 (or ⌘ ⌥ J on a Mac) and choose Console.

Copy the token

Run this in the console. It copies the current access token to your clipboard:

Browser console

copy(await DualMindAuth.getAccessToken())

Keep it out of your code

Store it in an environment variable, not in source control:

.env / shell

export DUALMIND_TOKEN="eyJhbGciOi..."

Your access token acts as you: anyone holding it can start battles, vote and read your private threads until it expires. Keep it in an environment variable and never paste it into shared code, issues or chats.

Check that it works

curl -i https://api.dualmindlab.tech/api/models \
  -H "Authorization: Bearer $DUALMIND_TOKEN"

const res = await fetch("https://api.dualmindlab.tech/api/models", {
  headers: { Authorization: `Bearer ${process.env.DUALMIND_TOKEN}` },
});
console.log(res.status, res.ok ? (await res.json()).items.length + " models" : res.headers.get("www-authenticate"));

import os, requests

r = requests.get(
    "https://api.dualmindlab.tech/api/models",
    headers={"Authorization": f"Bearer {os.environ['DUALMIND_TOKEN']}"},
    timeout=30,
)
print(r.status_code, len(r.json()["items"]) if r.ok else r.headers.get("WWW-Authenticate"))

A 200 with a list of models means you’re in. A 401 means the token is missing, malformed or expired.

Token lifetime

Tokens expire

Access tokens are short-lived (typically about an hour). The Arena refreshes its own session automatically; for scripts, copy a fresh token when you get a 401.

Reading a 401

Authentication failures return 401 with an empty body. The WWW-Authenticate response header says why, for example Bearer error="invalid_token", error_description="The token expired...".

Long-lived API keys

Personal API keys for scripts and integrations are planned. See the roadmap.

Last modified on October 18, 2026

Overview

Tutorials

Arena

Voting & leaderboard

Models

Threads

Utilities

Which endpoints need a token

Get your token

Check that it works

Token lifetime

​Which endpoints need a token

​Get your token

​Check that it works

​Token lifetime

Which endpoints need a token

Get your token

Check that it works

Token lifetime