问Google Drive API:下载文件出现lockedDomainCreationFailure错误

EN

function downloadFile(file, callback) {
  if (file.downloadUrl) {
    var accessToken = gapi.auth.getToken().access_token;
    var xhr = new XMLHttpRequest();
    xhr.open('GET', file.downloadUrl);
    xhr.setRequestHeader('Authorization', 'Bearer ' + accessToken);
    xhr.onload = function() {
      callback(xhr.responseText);
    };
    xhr.onerror = function() {
      callback(null);
    };
    xhr.send();
  } else {
    callback(null);
  }
}

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "lockedDomainCreationFailure",
    "message": "The OAuth token was received in the query string, which this API forbids for response formats other than JSON or XML. If possible, try sending the OAuth token in the Authorization header instead."
   }
  ],
  "code": 400,
  "message": "The OAuth token was received in the query string, which this API forbids for response formats other than JSON or XML. If possible, try sending the OAuth token in the Authorization header instead."
 }
}

GET /drive/v2/files/{file-id}?key={app-key}&alt=media&source=downloadUrl HTTP/3
Host: content.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: */*
Accept-Language: en,de;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: Bearer {oauth-token}
Origin: http://localhost:8800
DNT: 1
Connection: keep-alive
Referer: http://localhost:8800/
TE: Trailers