Greasy Fork

Your script somehow asks for XHR code from api.twitter.com outside of the domain twitter.com. As I only have allowed this for the domain twitter.com within the µMatrix settings (another good add-on to control script executions) your script does not work.

In order to make it work with µMatrix you have to explicitely allow XHR from api.twitter.com globally (e.g. by using the µMatrix logger and grand the permission there). But by setting this globally you create a data privacy leak (as api.twitter.com is allowed globally - for all websites). Since it would be extremely useful to avoid exactly that, I would like to ask you to adjust/update your script accordingly, if possible.

Thanks in advance!

Have you tried extension form https://chrome.google.com/webstore/detail/twitter-gif-video-downloa/dnplonfnokbnmniimndpkglalockjmbn?hl=en&authuser=0 ?
Does it still have the warning?

I do not use Chrome. Instead, I am using Firefox (also because of privacy but for performance, as well).

Can you link the UserScript extension you are using on Firefox?

µMatrix Add-On (to control domain scripts): https://addons.mozilla.org/de/firefox/addon/umatrix/
ViolentMonkey Add-On (to use Twitter DL script): https://addons.mozilla.org/de/firefox/addon/violentmonkey/
Twitter DL script: https://greasyfork.org/en/scripts/390723-twitter-download-gif-video/code

I've installed them to test it out and while
I've disabled api.twitter.com globally and allowed it on Twitter.com I still can download without a warning
The xhr requests are listed as "behind-the-scenes" in the logger
Can you screenshot your µMatrix settings for global and twitter and logger?

Edit: It appears you'll need to allow 'Behind the scene' to use api.twitter.com as it is necessary for extensions such as Violentmonkey to use it

If I disable api.twitter.com globally it is blocked when "behind-the-scene" and your script does not work.
If I enable api.twitter.com globally it is allowed when "behind-the-scene" and your script work but it creates a privacy leak.

Edit: It appears you'll need to allow 'Behind the scene' to use api.twitter.com as it is necessary for extensions such as Violentmonkey to use it

Ah, does this mean api.twitter.com is not really allowed globally but only for my own user scripts if I enable it only for "behind the scene"?

Hmm, here I have behind the scenes enabled while global is disabled:

Edit:

Edit: It appears you'll need to allow 'Behind the scene' to use api.twitter.com as it is necessary for extensions such as Violentmonkey to use it

Ah, does this mean api.twitter.com is not really allowed globally but only for my own user scripts if I enable it only for "behind the scene"?

Yes, it is not allowed for use by websites but allowed for use by extensions such as Violentmonkey and scripts it hosts

Oh boy, thanks a lot! I've also recognized you not only need to allow api.twitter.com but also video.twimg.com - everything works now.

NP! Enjoy!