I wanna get the latest release of my theme which is stored in a private repository using pre_set_site_transient_update_themes but I failed with the download link and the authentication.

I have no API request when I use this link on my private repository release (GitHub):

https://<my_token>:@api.github.com/repos/my_repo/releases/assets/latest

I used the documentation at GitHub and read, that I can use curl, JS or GitHub Cli. But I want to use a simple download link to use a native core function:

function updateTheme($transient) {
    $obj = json_decode($response['body'], true);
    $themeName="my_theme/functions.php";

    $themeArray = ($obj[$themeName]);
    $themeVersion = $themeArray['version'];
    $TOKEN = '<my_token>';
    $themePackage = "$TOKEN:@api.github.com/repos/my_theme/releases/assets/latest";
    $my_theme = wp_get_theme();
    $currentVersion = $my_theme->get('Version');

    if ($themeVersion > $currentVersion) {
        $update = array(
            'theme'        => 'my_theme',
            'new_version'  => $themeVersion,
            'url'          => '',
            'package'      => $themePackage,
            'requires'     => '7.4',
            'requires_php' => '7.4',
        );
        $transient->response['my_theme'] = $update;
    } else {
        // No update is available.
        $my_theme = wp_get_theme();
        $mytheme_current_version = $my_theme->get('Version');

        $item = array(
            'theme'        => 'my_theme',
            'new_version'  => $mytheme_current_version,
            'url'          => '',
            'package'      => '',
            'requires'     => '',
            'requires_php' => '',
        );
        // Adding the "mock" item to the `no_update` property is required
        // for the enable/disable auto-updates links to correctly appear in UI.
        $transient->no_update['my_theme'] = $item;
    }

        return $transient;
    }
}

add_filter('pre_set_site_transient_update_themes', 'updateTheme', 10, 3);

What is wrong with my release link or is it impossible to download a privat repository in this way?