The URLs that contain the actual audio recordings are accessible by everyone without the need to authenticate with teleapi. This is per design to allow for your apps to easily access the recordings without revealing your credentials. The same is NOT true for the resource to retrieve the list of recordings. Unauthenticated users cannot access the RecordingSid and hence not able to download the actual recording..