title: How to download GitHub release asset from private repo using node
body: <p>I would like to use node.js <code>request</code> module to download a release asset from a private repo. It works fine with the following <code>cURL</code> command:</p>
  
  <pre><code>curl -O -J -L \
       -H "Accept: application/octet-stream" \
  https://__TOKEN__:@api.github.com/repos/__USER__/__REPO__/releases/assets/__ASSET_ID__
  </code></pre>
  
  <p>but it fails when I try using the <code>request</code> module:</p>
  
  <pre><code>var request = require('request');
  
  var headers = {
      'Accept': 'application/octet-stream'
  };
  var API_URL = "https://__TOKEN__:@api.github.com/repos/__USER__/__REPO__"
  var ASSET_ID = __ASSET_ID__
  
  var options = {
      url: `${API_URL}/releases/assets/${ASSET_ID}`,
      headers: headers,
  };
  
  
  function callback(error, response, body) {
      if (error) {
          console.error(error);
      }
      console.log(response.statusCode)
      if (!error &amp;&amp; response.statusCode == 200) {
          console.log(body);
      }
  
      console.log(options.url);
  }
  var req = request(options, callback);
  console.log(req.headers)
  </code></pre>
  
  <p>I have double checked that the resulting URL when using <code>node</code> is the same as the one I use with <code>cURL</code>.</p>
  
  <p>I receive a <code>403</code> statusCode in the response. I do not understand why.</p>
  
  <p>UPDATE:
  While looking at the headers that are actually sent, I have found that the it uses </p>
  
  <pre><code>{ Accept: 'application/octet-stream',
    host: 'api.github.com',
    authorization: 'Basic __DIFFERENT_TOKEN__' }
  </code></pre>
  
  <p>I do not understand why the token is changed.</p>
  
  <p>some references: <a href="https://gist.github.com/maxim/6e15aa45ba010ab030c4" rel="nofollow noreferrer">https://gist.github.com/maxim/6e15aa45ba010ab030c4</a> </p>