How to get a feed from a password protected Discourse?

That sounds like a bug to me. The API key should function as the user associated with it. Are you passing the correct username through too?