I'm struggleing to download a single file from the API

novaut To download a file, it is correct to use the /2/files/download endpoint. You can find the information for using that endpoint in the documentation for /2/files/download here. As shown there, that endpoint supports "User Authentication", but not "App Authentication". There's also an curl example for that endpoint in endpoint documentation.

For reference, the "Authentication types" page lists different types that are used by different endpoints of the Dropbox API, but not every endpoint supports every type. The examples under each type show some example(s) of an endpoint which do support that type. For instance, the examples under "App Authentication" show the use of /2/files/get_thumbnail_v2, which does support App Authentication, but not /2/files/download.

So, to call /2/files/download, you need to use "User Authentication", which requires the an OAuth 2 access token as a "Bearer" token. It's not possible to successfully call /2/files/download using an app key/secret as "Basic" authorization.

And as Здравко noted, you need to authorize the app manually once, after which you can use the (short-lived) access token and refresh token. The "authorization code" can only be used once, in the process of retrieving the access token and refresh token. The refresh token doesn't expire automatically though, and can be re-used repeatedly without manual intervention to retrieve new short-lived access tokens whenever needed. You can find more information in the OAuth Guide and authorization documentation. There's a basic outline of processing this flow in this blog post which may serve as a useful example.