Blowdryer is predicated on the idea of URL whose content is immutable -> byte[]. When adding auth support, you want to be sure of two things:

1. the content from a URL shouldn't change because of an auth token, it should just turn a 403 error into a successful download
2. you don't want to pass an auth token from one service to anywhere else

With that in mind, here is where all downloads happen.

To add auth for any given service, you'll want to add a method to BlowdryerSetup with a name like githubAuth(String authToken) or something along those lines. Inside that method, you'll want to call Blowdryer.setAuthPlugin (new method). And then inside of download, you'll use that auth plugin to modify the request based on the URL. I'm not exactly sure what that auth plugin should do, but I think it should probably be something like Request authFor(String url, Request req).