What steps does it take to reproduce the issue?
The way privateUrlUser credentials are converted into an ApiToken in the Files API class doesn't provide a username for use in generating signedUrls (and username is required). This breaks generating signedUrls for use with externalTools/Previewers configured for signedUrls when accessed by a PrivateUrlUser.
Which version of Dataverse are you using?
5.14 - develop
PR to follow.