Another question - what is the recommended way to use private repositories with authentication?

I’m not sure about recommended or best way.. but piecing together “custom repositories” with how configuration is usually picked up for tools, I would expect that if you have a

~/.pip/pip.conf

or similar, that it would be picked up by pants. https://www.pantsbuild.org/v2.8/docs/python-third-party-dependencies#custom-repositories

Have you tried .netrc : https://pip.pypa.io/en/stable/topics/authentication/#netrc-support