You could add an option for the user to paste a token (fine grained etc) to retrieve only from repositories they grant via the token (and never write access)- and they can revoke at any time.