wp-json API: not logged in when clicking link to the API from admin mode

Question

I have a meta box on a custom post type which has an link in it. This link goes to an endpoint in the wp-json rest API. On the endpoint in the rest API I use current_user_can to verify if the user is logged in.

This is the endpoint, just changed the names:

register_rest_route( 'myapi', '/download_file/', array(
    'methods' => 'GET',
    'callback'    => 'file',
    'permission_callback' => function () {
        return current_user_can('administrator');
    }
) );

The endpoint downloads a file. The point is that you have to be logged in to download the file. However, when I click the link, I get a 403.

This is the link markup:

<a href="http://example.com/wp-json/myapi/download_file" target="_blank">
  Download file
</a>

Do I need to add something else to this link? Or do a post request with some proof I'm logged in?

EDIT: Maybe this is the problem:

On login, wordpress uses the wordpress_[hash] cookie to store your authentication details. Its use is limited to the admin console area, /wp-admin/ From here.

Answer 1

I needed to include the nonce in the URL. Solved it by adding ?_wpnonce=<?= wp_create_nonce( 'wp_rest' ); ?> to my URL. There is some info here, but I thought the nonuce wasn't needed unless I tried to alter data, or something like that. That the WordPress authentication cookie would be enough.