I don't know where to get the cookie token for lmarena free and qwen web free

[thezukiru]

Hi everyone,

Please help me, I can't figure this out at all!

I'm trying to use the LM Arena Free and Qwen Web Free providers, but I have no idea where to find the required cookie tokens. I've looked through the documentation but couldn't find clear instructions on how to extract them from the browser.

Could someone please explain:

• Where exactly do I find these cookies (which browser dev tools section)?
• What are the specific cookie names I should look for?
• Is there a step-by-step guide for copying them correctly?

If anyone knows how this works, I would really appreciate your help!

Thanks in advance.

[diegosouzapw]

Hey @thezukiru! Both providers need you to capture cookies from browser DevTools. Step-by-step for each:

LMArena Free (lmarena-free / alias lmf)

1. Go to arena.ai and log in (Google/GitHub OAuth works).
2. Open DevTools: F12 -> Application -> Cookies -> select arena.ai.
3. Copy all cookies as a single string in the format name=value; name2=value2.
4. In the OmniRoute provider form, paste the full string into the Cookie field (or the API Key field -- both are accepted).

Qwen Web (qwen-web / alias qww)

Qwen sits behind Alibaba's anti-bot layer, so you need the full cookie jar plus a bearer token.

1. Go to chat.qwen.ai and log in.
2. Open DevTools: F12 -> Application -> Cookies -> chat.qwen.ai.
3. Collect the full cookie string -- it must include cna, ssxmod_itna, and token.
4. Also grab the bearer token: in the Console tab, run localStorage.getItem('token').
5. In OmniRoute, paste the cookie string into Cookie and the bearer token into Access Token.

Note: Qwen cookies expire after ~7 days of inactivity -- you may need to re-capture them periodically.

Let me know if you hit any issues!

[xspylol]

Both LMArena (Free) and Qwen Web (Free) providers are failing cookie validation despite following the documented steps. The validation appears to have mismatched requirements and implementation issues.

DETAILED ISSUES:

1. LMArena Free (lmf)
   Problem: The UI field displays "Required cookie: session" but there is no cookie literally named "session" in the browser. The actual authentication cookie is named "arena-auth-prod-v1". When pasting the full cookie string (including "arena-auth-prod-v1=base64-eyJ..." and all other cookies), validation returns "Invalid" with error message "Provider validation not supported."

Steps taken:

• Logged into arena.ai via Google OAuth
• Captured full cookie string from DevTools (Application → Cookies → arena.ai)
• Pasted complete cookie string into both Cookie field and API Key field
• Also tried pasting only the "arena-auth-prod-v1" value without the cookie name
• All attempts return "Invalid" / "Provider validation not supported"

Expected: Validation should accept the cookie string containing the actual auth cookie (arena-auth-prod-v1).

2. Qwen Web (qww)
   Problem: Validation fails with "Invalid" and shows error "Redirect blocked for GET https://chat.qwen.ai/api/v2/models (307)" despite providing the full cookie header with all required cookies (cna, token, ssxmod_itna, ssxmod_itna2).

Steps taken:

• Logged into chat.qwen.ai
• Captured full cookie string from DevTools Network tab (Request Headers → Cookie)
• Cookie string includes all required cookies: cna, token, ssxmod_itna, ssxmod_itna2 plus additional cookies
• Pasted complete cookie string into Session Cookie field
• Validation returns "Invalid" with 307 redirect error

Expected: Validation should accept the cookie jar and successfully verify the session.

ADDITIONAL NOTES:

• The developer instructions mention needing a separate "bearer token" from localStorage.getItem('token') for Qwen, but the UI only has one "Session Cookie Label" field. It's unclear where to paste the bearer token.
• Both providers appear to have validation logic that doesn't match the documented requirements or UI field labels.

REQUEST:
Please clarify the exact cookie format expected for each provider and update the UI field labels to match the actual cookie names. For Qwen, please specify where the bearer token should be entered if it's separate from the cookie string. (Also out of topic the amonia "new session every message" and tool call failed error and cant run terminal commands using web cookie providers, Might give me a hint when is gonna be fixed?

[diegosouzapw]

Thanks for the detailed breakdown, @xspylol!

LMArena Free -- "Provider validation not supported"

This is cosmetic. The Test button doesn't have a probe for cookie-based lmarena auth, so it returns "Invalid" even when the cookie is fine. Just skip the validation step and make an actual request (lmf/MODEL_NAME) to confirm the cookie works.

The UI hint "Required cookie: session" is stale -- lmarena.ai changed the auth cookie name to arena-auth-prod-v1. Pasting the full cookie string (e.g. arena-auth-prod-v1=base64...; _ga=...) is the correct approach and is accepted as-is. Opening an issue to update the label -> see #3787.

Qwen Web -- "Redirect blocked for /api/v2/models (307)"

That specific redirect was fixed in v3.8.23 -- the validator now probes /api/v2/user instead of the models endpoint. What OmniRoute version are you on? If you're already on v3.8.23+, please share the full error from the dashboard console so I can investigate further.

Bearer token for Qwen -- no separate field needed. If your cookie string includes token=xxxx, extractQwenToken reads it automatically from the cookie header. Paste the full cookie string into the Session Cookie field and leave Access Token blank.

New session per message -- yes, this is by design. Web-cookie providers open a new conversation on the upstream platform for every OmniRoute request. A persistent-session architecture is tracked in #3153.

Tool calls / terminal commands -- tool-use support depends on what the upstream web app exposes. If the underlying model's web interface doesn't offer tool use, OmniRoute can't add it on top.

[diegosouzapw]

Correction: the lmarena label fix is tracked in #3810 (not #3787 as mentioned above -- typo on my end).

[thezukiru]

@diegosouzapw I know what's in the repository Qwen2API_Go we've implemented a login-password account registration system. Could you try implementing the same? I'm not particularly knowledgeable about this, but I'm just curious. I'd appreciate your feedback.

The message was written using Google Translate. Thanks! ✌️

[diegosouzapw]

Hey @thezukiru! Username/password auto-login for Qwen is technically possible but significantly more complex than the current cookie approach.

Why cookies are preferred today: The cna + ssxmod_itna + token flow reuses an already-authenticated browser session -- no CAPTCHA, no OTP/2FA to bypass, and no login-rate throttling to handle. Cookies are exactly what Qwen's WAF expects from real browser clients.

What a user/pass flow would require: Simulating the full Aliyun auth sequence (including slider/image CAPTCHA and optional 2FA), persisting the resulting session cookies, and re-authenticating when they expire. This is what Qwen2API_Go does -- but it's fragile: any login-API change breaks it, and automation trips the WAF much faster than a real session.

Current path: qwen-web already runs the v2 flow (/api/v2/chats/new + /api/v2/chat/completions). When your cookies expire, you just paste fresh ones from DevTools.

If you'd like to see username/password auto-login tracked as a feature, open a dedicated Ideas discussion and link to Qwen2API_Go as a reference implementation -- that would be the right place to scope it out properly.

[diegosouzapw]

Closing this thread as stale due to inactivity.

No maintainer follow-up happened after the last maintainer message for over 15 days. If this is still relevant, feel free to open a new discussion with fresh logs/steps and I’ll pick it up with updated context.

[diegosouzapw]

Closing this thread as stale due to inactivity.

No maintainer follow-up happened after the last maintainer message for over 15 days. If this is still relevant, feel free to open a new discussion with updated logs/steps and I’ll pick it up with fresh context.