Authentication

Session cookies, Basic, Bearer and Google Drive.

Credentials are sent on the first request and on every segment. They stay in memory: never in downloads.json, in a state file or in the logs.

Session cookies

This is the most common case (private Google Drive, OneDrive, member areas):

• from the browser: the extension sends the site's cookies along with the link, once Send the site's cookies is on in its popup;
• on the CLI: -b "name=value" or --cookies-file cookies.txt (Netscape format, exported by a browser extension).

HTTP Basic

• App: Authentication section of the add dialog. If the server answers 401, the row shows a key button to enter the credentials.
• CLI: -u alice (password asked without echo) or auth.password_env in the profile.
• MCP: auth.user and auth.password_env in the server's profile.

Bearer token and other headers

turbodl-cli default https://api.example.com/f.zip -H 'Authorization: Bearer ${TOKEN}'

In the app: the "Headers" field of the add dialog, one Name: value per line.

Google Drive

drive.google.com/file/d/<ID>/…, open?id=<ID> and uc?id=<ID> links are turned into a direct download link. For large files, Google shows a "can't scan this file for viruses" page: TurboDL reads the confirmation form and carries on by itself.

Login page instead of the file

When a server returns an HTML page where a file is expected, TurboDL stops with "login page received instead of the file" instead of saving that page. Start the download again from the browser (fresh cookies) or add the authentication.