All from Nova docs.
Composer Authentication: When running composer update, you will be prompted to provide your login credentials for the Nova website. These credentials will authenticate your Composer session as having permission to download the Nova source code. To avoid manually typing these credentials, you may create a Composer auth.json file while optionally using your API token in place of your password.
https://nova.laravel.com/docs/1.0/installation.html#installing-nova-via-composer
https://getcomposer.org/doc/articles/http-basic-authentication.md