You can also use a deploy key. That's how I do it while avoiding adding a PAT to a shared repo