Why can't I install plugins locally?

Support Self-hosting
8

A private GitHub/GitLab repo is still private. The token is just a password that lets the server clone it. Nobody else can see the code. It stays private.

See the section about private repos in Install plugins on a self-hosted site