I am not familiar with the tool you are using. But you need to set a valid access token (the token you use to read the same call log record that gives you the call recording contentUri) to the HTTP Authorization header. Here is an example how I set it in Node JS.

const download_new = function(domain, path, accessToken, dest, cb) {

    var file = fs.createWriteStream(dest);

    var options = {

          host: domain,

          path: path,

          method: "GET",

          headers: {

            Authorization: `Bearer ${accessToken}`

          }

      }

    const req = https.request(options, res => {

    console.log(`statusCode: ${res.statusCode}`)

    res.pipe(file);

    file.on('finish', function() {

        file.close(cb);

    });

  })

  req.on('error', error => {

    console.error(error)

  })

  req.end()

}

Where the domain and path is taken from the contentUri

domain: media.ringcentral.com

path: /restapi/v1.0/account/xxxx/recording/xxxxxxxx/content