Hey, you can download the url of the attachment from the API - of course, during the time that's settled for this link to expire, which is available for 15 minutes. You can use the code you want, since the url provided by the API will give you the file of the attachment. Besides that, could you please tell me more about the using cookies?

An example of the logic you can use for this can be described in this JS snippet here: 
 

function onStartedDownload(id) {
  console.log(`Started downloading: ${id}`);
}
function onFailed(error) {
  console.log(`Download failed: ${error}`);
}
var downloadUrl = "https://example.org/image.png";
var downloading = browser.downloads.download({
  url : downloadUrl,
  filename : 'my-image-again.png',
  conflictAction : 'uniquify'
});
downloading.then(onStartedDownload, onFailed);

Here another one in Python: 

import requests

url ='https://s3.amazonaws.com/sample-login/companies/avatars/000/004/594/original/pipe_logo.png?1579786798'

img_data = requests.get(url).content
with open('pipefy.png', 'wb') as handler:
    handler.write(img_data)