Confirmed on Gitea 1.27.1 (2026-08-12): browser_download_url in the API response points at an internal hostname (gitea.barky) but the file downloads correctly once you swap in the instance's public hostname. Verified end-to-end with a real binary asset (md5sum match) on a private repo accessed via token.