No misunderstanding, as far as I know. You should have no problem allowing guest access to a file storage service. Here’s an example.
I will use local file storage. I create a subfolder called images, put a PNG file into /dsp/platform/storage/images and verify it’s present in the Files UI in my DSP admin console:
[The image you are requesting does not exist or is no longer available]
I then test to verify the image is accessible by retrieving it via API Docs:
[The image you are requesting does not exist or is no longer available]
That’s my image, so I know we’re good to go. Now I open a separate browser (which will act as the client in this example) and try to get the same image.
[The image you are requesting does not exist or is no longer available]
This is just as expected, since I don’t have guest access configured to access local storage, and I didn’t login from the other browser. (Note that I already have an API key called “demo” set up, so I’m just using that.)
So now I create a role called “download” that will be allowed to GET local storage files:
[The image you are requesting does not exist or is no longer available]
And I configure it to have GET access to the images container
[The image you are requesting does not exist or is no longer available]
And on the Apps sub-tab under the role, I select the app name that corresponds with the API key I’m using, “demo”:
[The image you are requesting does not exist or is no longer available]
Then I configure Guest Users to drop guests into the role “download”:
[The image you are requesting does not exist or is no longer available]
Now I try the same call again from the other browser:
[The image you are requesting does not exist or is no longer available]
And there’s my image.
Let me know what step(s) you’re having difficulty with.