@jamie The best way is to request it from their own server, using cookies or OAuth, which then fetches it using HTTP Signatures for authentication. There's a standard way, using `proxyUrl`, or you can use a per-server API, which is what Mastodon does. Either way, it's your server fetching the file (and usually caching it).