Create a temporary download link first
Someone hit the raw stream URL for a public file without a temporary grant token. The product requires minting a link from the file page first (anti hotlinking).
Why this happens
GET /{id}/stream (and similar) returns 403 with token_required / mint-first when file.isPublic and no valid grant. Normal visitors use Create download link → /api/download/grant → /d/{token}. Owners of private files can bypass differently.
Diagnose and fix
1. Visitor: open the file download page and use Create download link / Download, not a hotlinked stream URL.
2. Integrators: mint a grant, then use the token URL — do not scrape /stream for public files.
3. Admin: grant rate limits (Grant rate limit per IP/file) if mint is blocked for other reasons.
4. Distinct from bandwidth or captcha failures on the landing page.