Is there a practical way to programatically download password protected file without setting up an account and an app? It is easy to do in the browser, but API seems to require Authorization even though user should not be relevant.
No, unfortunately the API functionality for this (/2/sharing/get_shared_link_file) currently only supports "user authentication", which does require an app and user. I'll pass this along as a feature request though.
