The downloader must be able to use auth credentials like composer.

Initially HTTP Basic Auth, Bearer Auth and specifying an arbitrary HTTP header should be sufficient.