InstallAware

We are using the scheduled updates functionality of InstallAware. It seems though, that the updates are expected to be publicly available with no option for any sort of authentication. I cannot seem to pass basic auth credentials via the URL and I see no way to alter the headers for the download request.

Is there some form of abuse mitigation that InstallAware supports such that we don't have to have our updates available to the world?

Unfortunately, there isn't any built-in method available.

Due security restrictions, credentials via the URL are not allowed.
You can, I suppose, implement your own authentication using query parameters.