This is the expected behavior. The API requires an access token to access it. If the user hits the env URL first, the access token will be generated automatically, so the Download function will work.
Please click Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider giving it a Like.