Your question has 2 parts:

how can I use private access tokens to download[?]

Since this is a WORKSPACE file (which is in source control), it is generally frowned upon to put creds directly in this file. Bazel 7.0 supports --credential_helper which you should use for this. But that means, the runtime (or your CI) would need to provide have a creds helper.

See more in EngFlow's blog: Configuring Bazel's Credential Helper

If you are just running locally - I've had success putting creds in ~/.netrc file.

[how can I] extract libraries from artifact?

bazel will do this for you. It support a lot of the popular compression formats. From the http_archive docs:

Downloads a Bazel repository as a compressed archive file, decompresses it, and makes its targets available for binding.

It supports the following file extensions: "zip", "jar", "war", "aar", "tar", "tar.gz", "tgz", "tar.xz", "txz", "tar.zst", "tzst", tar.bz2, "ar", or "deb".