diff --git a/heicode/router/api-router.go b/heicode/router/api-router.go
index 00d1010..eac5cd3 100644
--- a/heicode/router/api-router.go
+++ b/heicode/router/api-router.go
@@ -68,6 +68,12 @@ func SetApiRouter(router *gin.Engine) {
 			userRoute.GET("/epay/notify", controller.EpayNotify)
 			userRoute.GET("/groups", controller.GetUserGroups)
 
+			// Heicode desktop installer file streaming — uses TokenOrUserAuth so a plain
+			// browser <a href> download (cookie only, no New-Api-User header) works.
+			// The metadata endpoint stays on selfRoute since the SPA's axios layer
+			// already injects the required header.
+			userRoute.GET("/desktop-downloads/file/:platform", middleware.TokenOrUserAuth(), controller.DownloadDesktopFile)
+
 			selfRoute := userRoute.Group("/")
 			selfRoute.Use(middleware.UserAuth())
 			{
@@ -77,9 +83,8 @@ func SetApiRouter(router *gin.Engine) {
 				selfRoute.PUT("/self", controller.UpdateSelf)
 				selfRoute.DELETE("/self", controller.DeleteSelf)
 				selfRoute.GET("/token", controller.GenerateAccessToken)
-				// Heicode desktop client installers (paths from env, login required)
+				// Heicode desktop client installers metadata (login required)
 				selfRoute.GET("/desktop-downloads", controller.GetDesktopDownloads)
-				selfRoute.GET("/desktop-downloads/file/:platform", controller.DownloadDesktopFile)
 
 				selfRoute.GET("/passkey", controller.PasskeyStatus)
 				selfRoute.POST("/passkey/register/begin", controller.PasskeyRegisterBegin)