A couple things:

• Would be good to make the ssh vs https an option, defaulting to https (though I prefer ssh personally). BC compatibility and all.
• Have you tried seeing what happens when you use your token against that user in /users/$USER/repos? Pretty sure that should work.

• True. I can rework the PR to do that.
• Well, that's what the documentation says, indeed, but it doesn't seem to work:

$ curl -H "Authorization: token $(cat token.secret)" https://api.github.com/users/durka/repos?type=all 2>/dev/null | grep '"private"' | sort | uniq
    "private": false,

Thats so odd...

Actually, reading that doc again, it says /users/:username/repos lists only the public repositories. So to get the private ones you have to use /user/repos.

PR updated with some more changes, including the option for SSH. I added some consistency checks so you can't pass -u and -t that don't match, and you can't pass -P if the authentication doesn't match USER.

- check the real username when an auth token is provided (error if
  it doesn't match)
    - this caused an infinite loop between get_auth/retrieve_data,
      so I added a parameter to retrieve_data to escape that
- error if you pass -P but someone else's username
- optionally use SSH instead of HTTPS to clone

One more update: I realized that retrieve_data calls get_auth every time, and since I added an API call to get_auth that's not a good idea. So I memoized get_auth.

I'll take a closer look at this tonight, thanks for the pull request :)

This should work now - tested against my own account and an organization. If not, please reopen against master.

I ran the following command

github-backup -u durka -t $REDACTED -o test --repositories -P durka

and it did not include my private repositories. That token has permissions repo, gist, read:org, user. I'm assuming I made some simple mistake...