diff --git a/internal/auth/middleware.go b/internal/auth/middleware.go
index 4a7d1be..beedff6 100644
--- a/internal/auth/middleware.go
+++ b/internal/auth/middleware.go
@@ -28,6 +28,12 @@ func Middleware(jwtService *JWTService) func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			// Get the Authorization header
 			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				// Browser download links cannot set headers; accept the token as a query parameter.
+				if t := r.URL.Query().Get("token"); t != "" {
+					authHeader = "Bearer " + t
+				}
+			}
 			if authHeader == "" {
 				http.Error(w, "Authorization header required", http.StatusUnauthorized)
 				return