with CURL:
curl -L -F "login=$USER" -F "token=$TOKEN" https://github.com/$USER/$REPO/$PKGTYPE/$BRANCHorTAG
where $TOKEN is the API token on your github profile, not an oAuth2 token used for communicating with the APIv3.
$USER is the user account the token is connected with, not necessarily the organization/other user the repo belongs to. Second Instance of $USER is the user/account the repo is.
$REPO is the name of the private repository
$PKGTYPE is tarball or zipball and $BRANCHorTAG is a branch, like master, or a tag name for a commit.
The first instance of $USER must have access to the repo belonging to the second instance of $USER.
I could not find this documented ANYWHERE, so I also have a little write up about it if you want anything more detailed.