Sure
It is a working link via browser
GET /d/{token}/files/?p=%2FText.txt
It leads to preview page with download button that uses
GET /d/{token}/files/?p=%2FText.txt&dl=1
It works
The thing is, If I use link with &dl=1 without any browser cookies, for example, from Postman, the answer is HTML page with “Please input the password if you want to browse the shared file/directory” and 200 as status.
Tried adding &password={password} - same response
Just for the science, i’m tried POST with same link - html with 403 and “CSRF verification failed. Request aborted” inside