> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/pterodactyl/wings/llms.txt
> Use this file to discover all available pages before exploring further.

# Download File

> Download a file from the server using a signed URL

## Endpoint

```
GET /download/file
```

## Authentication

This endpoint uses **JWT authentication** via a signed download URL token, not Bearer token authentication.

The JWT token must be included in the query string as the `token` parameter.

## Query Parameters

<ParamField query="token" type="string" required>
  Signed JWT token authorizing the download. Generated by the Panel.
</ParamField>

## JWT Payload

The JWT token must contain:

<ParamField body="server_uuid" type="string" required>
  The UUID of the server
</ParamField>

<ParamField body="file_path" type="string" required>
  Path to the file to download (relative to server root)
</ParamField>

<ParamField body="unique_id" type="string">
  Optional unique identifier for one-time use enforcement
</ParamField>

## Response

Returns the raw file contents with download headers:

* `Content-Disposition`: attachment with filename
* `Content-Type`: application/octet-stream
* `Content-Length`: File size in bytes

## Example Request

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://wings.example.com/download/file?token=SIGNED_JWT_TOKEN" \
    -o downloaded-file.txt
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    'https://wings.example.com/download/file?token=SIGNED_JWT_TOKEN'
  );
  const blob = await response.blob();
  const url = window.URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = url;
  a.download = 'filename.txt';
  a.click();
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      'https://wings.example.com/download/file',
      params={'token': 'SIGNED_JWT_TOKEN'},
      stream=True
  )

  with open('downloaded-file.txt', 'wb') as f:
      for chunk in response.iter_content(chunk_size=8192):
          f.write(chunk)
  ```
</CodeGroup>

## Behavior

* JWT tokens are typically one-time use and invalidated after the first download
* File content is streamed directly to the client
* The filename in `Content-Disposition` header is extracted from the file path
* Path traversal is prevented - files outside the server directory cannot be accessed

<Info>
  Download URLs are typically generated by the Pterodactyl Panel when a user initiates a file download through the UI.
</Info>

## Error Responses

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    Missing or invalid JWT token, or token has already been used (one-time tokens)
  </Accordion>

  <Accordion title="404 Not Found">
    Server or file does not exist
  </Accordion>

  <Accordion title="500 Internal Server Error">
    Failed to read file
  </Accordion>
</AccordionGroup>

## JWT Token Generation

Download tokens are generated by the Panel and should:

* Include `server_uuid` and `file_path` claims
* Have a short expiration time (recommended: 5-15 minutes)
* Include a `unique_id` claim for one-time use enforcement

## Use Cases

* Download world/map backups
* Export configuration files
* Download log files for analysis
* Retrieve generated reports

## Source Reference

Implementation: `router/router_download.go` (getDownloadFile function)