Endpoint
Authentication
This endpoint uses JWT authentication via a signed download URL token, not Bearer token authentication. The JWT token must be included in the query string as thetoken parameter.
Query Parameters
Signed JWT token authorizing the download. Generated by the Panel.
JWT Payload
The JWT token must contain:The UUID of the server
Path to the file to download (relative to server root)
Optional unique identifier for one-time use enforcement
Response
Returns the raw file contents with download headers:Content-Disposition: attachment with filenameContent-Type: application/octet-streamContent-Length: File size in bytes
Example Request
Behavior
- JWT tokens are typically one-time use and invalidated after the first download
- File content is streamed directly to the client
- The filename in
Content-Dispositionheader is extracted from the file path - Path traversal is prevented - files outside the server directory cannot be accessed
Download URLs are typically generated by the Pterodactyl Panel when a user initiates a file download through the UI.
Error Responses
401 Unauthorized
401 Unauthorized
404 Not Found
404 Not Found
Server or file does not exist
500 Internal Server Error
500 Internal Server Error
Failed to read file
JWT Token Generation
Download tokens are generated by the Panel and should:- Include
server_uuidandfile_pathclaims - Have a short expiration time (recommended: 5-15 minutes)
- Include a
unique_idclaim for one-time use enforcement
Use Cases
- Download world/map backups
- Export configuration files
- Download log files for analysis
- Retrieve generated reports
Source Reference
Implementation:router/router_download.go (getDownloadFile function)