It turns out that ghcr.io uses basic authentication in the form of <username>:<PAT>

So it would look something like this.

curl -H "Authorization: Basic $BASE64_CREDENTIALS" "https://ghcr.io/token?service=ghcr.io&scope=repository:<user>/<image>:pull"

{"token":"xyz"}