As admin, enable "Mobile services": Site administration ► Mobile app ► Mobile settings Create a Token in the mobile app service for any user in the site (not an admin account) Click on Site administration ► Plugins ► Web services ► Manage tokens With any text editor, create a new .txt file named "drafttest.txt" it can have any random content Now, log in with the user you created the token for Go to Private files Upload the "draftest.txt" file DO NOT click Save changes yet Now, you need to extract the download URL for that file, in order to do this you can: Enable the browser Developer tools, activating the Network tab Click on the "drafttest.txt" file in the browser and click the Download button In the network tab you will see the URL used for downloading the file, copy the URL, it should have a format like: http://YOURSITE/draftfile.php/XX/user/draft/YY/drafttest.txt Now, create a new URL by: Appending at the end the following: ?token=TOKEN_FROM_STEP_2 Adding "webservice/" just before draftfile.php Example: http://YOURSITE/webservice/draftfile.php/XX/user/draft/YY/drafttest.txt?tokenn=XYZ Now, copy the previous new URL in a browser where you are not authenticated with any user and confirm that: The drafttest.txt file is downloaded from the server The contents of the file are ok/correct