I think the API key can also just have a `public_repo` scope if the repository in question is a public repository?