# SPM support basic auth for non-git binary dependency hosts

**URL:** <https://forums.swift.org/t/spm-support-basic-auth-for-non-git-binary-dependency-hosts/37878>\
**Category:** Using Swift\
**Tags:** packagemanager\
**Created:** [June 24, 2020, 11:50pm UTC](https://forums.swift.org/t/spm-support-basic-auth-for-non-git-binary-dependency-hosts/37878 "2020-06-24T23:50:31Z")\
**Posts on this page:** 1\
**Showing post:** 35

<div class="post-metadata">

**Author:** ![tallariel](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/tallariel/32/17900_2.png) [@tallariel](https://forums.swift.org/u/tallariel)\
**Post date:** [October 26, 2021, 2:07pm UTC](https://forums.swift.org/t/spm-support-basic-auth-for-non-git-binary-dependency-hosts/37878/35 "2021-10-26T14:07:45Z")

</div>

For reference, and to clarify @theRealRobG 's doubts, here is the `curl` call to download release assets (not release source code) via the GitHub REST API:

```nohighlight
curl \
    --location \
    --output release_asset.zip \
    -H "Accept: application/octet-stream" \
    -H "Authorization: token MY_GITHUB_PAT" \
    "https://api.github.com/repos/{owner}/{repo}/releases/assets/{release_id}"

```

Where MY\_GITHUB\_PAT is a GitHub PAT with full `repo` permissions. You can find the full URL by copying the URL of the required release asset in the release's page on GitHub, and via the [GitHub CLI](https://github.com/cli/cli):

```bash
$ gh release view THE_RELEASE_TAG --json apiUrl

```

The `curl` call can leverage a `netrc` file thus (as @MPLewis points out):

```swift
$ cat ~/.netrc 
machine api.github.com
    login MY_GITHUB_PAT

curl \
    --location \
    --netrc \
    --output release_asset.zip \
    -H "Accept: application/octet-stream" \
    "https://api.github.com/repos/{owner}/{repo}/releases/assets/{release_id}"

```

It looks like Xcode 13 fails to add Swift packages that specify a `binaryTarget` with the URL of a GitHub asset in a private repo (even with a correctly formatted `~/.netrc` file with suitable credentials):

```swift
    targets: [
        .binaryTarget(
            name: "FrameworkName",
            url: "https://api.github.com/repos/{owner}/{repo}/releases/assets/{release_id}",
            checksum: "f7c06...."

```

I got in touch with GitHub support and they've confirmed that the GitHub API doesn't currently support this SPM functionality.

@NeoNacho How could we go about supporting this functionality in a future release of SPM?

---

_[View the full topic](https://forums.swift.org/t/spm-support-basic-auth-for-non-git-binary-dependency-hosts/37878)._