I spent a while looking for the answer to this as well. Apparently it is possible.
Essentially the steps are as follows:
- On the server, make a GET request to the b2_authorize_account endpoint, to get an auth token (https://www.backblaze.com/b2/docs/b2_authorize_account.html)
- Also on the server, make a POST request to the b2_get_download_authorization endpoint to get a more specific auth token used just for downloading (https://www.backblaze.com/b2/docs/b2_get_download_authorization.html)
- Form the download URL by combining the apiUrl from step 1, with the path to the specific file, and then appending the token from step 2 as a query param (this is the part that's very difficult to find in their documentation).
- Send the download URL out to the browser, and the user can click it to access the file.
So you'll get something like
https://api001.backblazeb2.com/file/bucket-name/path/to/file?Authorization={token}
You can restrict the length of time that the auth token is valid, and restrict it so that only files which have a particular prefix can be accessed. So if you want to make a particular private file available to a particular user that you've already authenticated, you can use these steps to generate a token with a short lifetime that only works for the specific file (by using the full file name as the prefix).