Download asset from private github repo with python

Question

I'm trying to download the latest release from my private github repo. I've setup a token, I can retrieve the release information, but I can't download the release.

import requests
from requests.auth import HTTPBasicAuth

r = requests.get(
    'https://MYTOKEN:@api.github.com/repos/andrewtquick/releasetest/releases/latest')
d = r.json()['assets'][0]["browser_download_url"]

with open('c:/temp/app.exe', 'wb') as f:
    download = requests.get(d, headers={'Authorization': 'MYTOKEN'})
    f.write(download.content)

I keep getting 404 responses.. I've tried to use my token in the headers and also tried to use my login credentials with requests HTTPBasicAuth.. Nothing seems to work..

When I check the accepted headers for the url, I get the following:

{'Server': 'GitHub.com',
'Date': 'Thu,
09 Jul 2020 17:34:47 GMT',
'Content-Type': 'application/json; charset=utf-8',
'Transfer-Encoding': 'chunked',
'Status': '200 OK',
'X-RateLimit-Limit': '5000',
'X-RateLimit-Remaining': '4992',
'X-RateLimit-Reset': '1594318601',
'Cache-Control': 'private,
max-age=60,
s-maxage=60',
'Vary': 'Accept,
Authorization,
Cookie,
X-GitHub-OTP,
Accept-Encoding,
Accept,
X-Requested-With',
'ETag': 'W/"44f010aed319d40ab177528a8f41dc78"',
'X-OAuth-Scopes': 'read:packages,
repo',
'X-Accepted-OAuth-Scopes': 'repo',
'X-GitHub-Media-Type': 'github.v3; format=json',
'Access-Control-Expose-Headers': 'ETag,
Link,
Location,
Retry-After,
X-GitHub-OTP,
X-RateLimit-Limit,
X-RateLimit-Remaining,
X-RateLimit-Reset,
X-OAuth-Scopes,
X-Accepted-OAuth-Scopes,
X-Poll-Interval,
X-GitHub-Media-Type,
Deprecation,
Sunset',
'Access-Control-Allow-Origin': '*',
'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload',
'X-Frame-Options': 'deny',
'X-Content-Type-Options': 'nosniff',
'X-XSS-Protection': '1; mode=block',
'Referrer-Policy': 'origin-when-cross-origin,
strict-origin-when-cross-origin',
'Content-Security-Policy': "default-src 'none'",
'Content-Encoding': 'gzip',
'X-GitHub-Request-Id': '4E08:54CB:3CB13C:671519:5F075537'}

I can see the Authorization header and the Accept header. I've tried using github's recommendation on setting the header to 'application/octet-stream', but this doesn't work either.

Answer 1

Usually, MYTOKEN is used as password:

 r = requests.get(
'https://<username>:MYTOKEN@api.github.com/repos/andrewtquick/releasetest/releases/latest')

As in this example :

url = urljoin(GITHUB_API, 'authorizations')
payload = {}
if note:
    payload['note'] = note
res = requests.post(
    url,
    auth = (username, password),
    data = json.dumps(payload),
    )

Except you would replace the GitHub account password by a PAT (Personal Access Token) .