I've also seen some private/paid RSS feeds just using tokens in query parameters (I think Patreon and Ars Technica do this), eg 'https://www.patreon.com/rss/foo

I've also seen some private/paid RSS feeds just using tokens in query parameters (I think Patreon and Ars Technica do this), eg 'https://www.patreon.com/rss/foo?auth= https://www.patreon.com/rss/foo?auth=...' I'm not entirely sure what the benefit of one over the other is, unless some RSS readers/podcast apps have issues with Basic Auth or maybe it's just easier to fit into existing code server-side.