Download released asset from private repo

I’m trying to download a single asset from a release in a private repository but all I get is a 404 response. the download url of the asset is

I’ve tried several different methods of specifying the username and private access token but all give the same result. When I use the access token to access then it seems to work.

I’ve tried the following formats in curl

curl -i -u <user>:<token> <url>
curl -i "https://<user>:<token> ...."
curl -i -H "Authorization: token <token>" <url>

I can download the source code (zip) from the release, but this has a different url:

What am I doing wrong?

If you have access to the GitHub API, can’t you use the URL from the API (starting with
Releases - GitHub Docs

the api endpoints onlyreturn the metal data of the asset. including a download_url which is the url