If there are selenium UI results for this code they will be at filesenderuici@78598cc

Can you explain how to use this? A recipient has only a token, but if I hit this new endpoint, it says I need to authenticate

$ curl 'https://filesender.aarnet.edu.au/rest.php/transfer/fileids?token=my-download-uuid-token'
{"message":"rest_authentication_required","uid":"6683a5db7c2e3","details":{"method":"get","endpoint":"transfer"}}

Hey @multimeric,
I was having a play with this earlier today, this endpoint still requires authentication but you should have no issues getting files from any valid download token.

Reading the related file changes, this seems like the desired behavior.

If you sign the request like normal do you have any issues?

this endpoint still requires authentication

Yes but the person who has been sent a transfer potentially has no credentials at all. They are neither a FileSender user, nor a guest (which is only for voucher uploads). So possibly my problem is still outstanding?