Downloading captions always returns a 403

When I call the captions.download endpoint with an ID that we retrieve from the captions.list endpoint, it always returns a 403. For example:

https://www.youtube.com/watch?v=1HRwpwOj4aA

I call captions.list with:

GET https://www.googleapis.com/youtube/v3/captions?part=id&videoId=1HRwpwOj4aA&key={YOUR_API_KEY}

This is response:

cache-control:  private, max-age=0, must-revalidate, no-transformcontent-encoding:  gzipcontent-length:  236content-type:  application/json; charset=UTF-8date:  Sat, 23 May 2015 17:55:57 GMTetag:  "dhbhlDw5j8dK10GxeV_UG6RSReM/Rztb3ln4Zb6O07vb7_KSZi2y1NM"expires:  Sat, 23 May 2015 17:55:57 GMTserver:  GSEvary:  Origin, X-Origin{"kind": "youtube#captionListResponse","etag": "\"dhbhlDw5j8dK10GxeV_UG6RSReM/Rztb3ln4Zb6O07vb7_KSZi2y1NM\"","items": [  {"kind": "youtube#caption","etag": "\"dhbhlDw5j8dK10GxeV_UG6RSReM/pwH-4wtyQJz0U3l57fA8uKm4e1I\"","id": "kHlUsiuNS4TjB25loauZNXGrjK91I1tEdNyOpTRNA78="  } ]}

When I use the above id to call captions.download:

GET https://www.googleapis.com/youtube/v3/captions/kHlUsiuNS4TjB25loauZNXGrjK91I1tEdNyOpTRNA78%3D?key={YOUR_API_KEY}

This is response:

403 Forbiddencache-control:  private, max-age=0content-encoding:  gzipcontent-length:  29content-type:  text/html; charset=UTF-8date:  Sat, 23 May 2015 17:59:05 GMTexpires:  Sat, 23 May 2015 17:59:05 GMTserver:  GSEvary:  Origin, X-OriginForbidden

Any ideas what could be happening here?