Access denied when downloading file written to OneDrive using Microsoft Graph API with Files.ReadWrite.All scope

I believe I have figured out the problem. I have managed to successfully download the file using a GET request to the downloadUrl retrieved from the file's metadata. The key apparently was to NOT pass my access token with the GET request. So, ironically, If I pass my access token I get access denied, if I don't pass any access token I can successfully download the file.

The docs do state that when downloading directly from the downloadUrl:

Pre-authenticated download URLs are only valid for a short period of time (a few minutes) and do not require an Authorization header to download.

I think maybe this should state instead that you MUST NOT send an Authorization header?

I'm still a bit confused as to why my GET request to https://graph.microsoft.com/v1.0/me/drive/root:/path/to/file.txt:/content fails with the same authentication denied error. My best guess is this: the docs state that when you use this method to download a file, you actually get a http Redirect response, which redirects the http client to the download URL. So I wonder if my http client (I'm using Cronet for Android) passes on the same headers (including my access token) from the original request to the redirected URL, which triggers the same problem as above - the presence of the access token is actually causing the access denied error. I'm not actually sure how to test what headers are sent in the redirected request so I can find out for sure, but it would make sense if that is the problem.