diff --git a/CHANGES.rst b/CHANGES.rst
index 9546ab6..c65ab20 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,6 +7,8 @@ Changelog
 
 - Add support for Python 3.10.
 - Drop support for Python 3.6.
+- Fix ``ghcloneall --user ... --github-token ... --include-private`` not
+  including any private repositories (GH: #16).
 
 
 1.10.1 (2021-05-26)
diff --git a/ghcloneall.py b/ghcloneall.py
index c0ca68e..fbc36ea 100755
--- a/ghcloneall.py
+++ b/ghcloneall.py
@@ -398,6 +398,7 @@ def __init__(self, dry_run=False, verbose=0, progress=None, quiet=False,
         self.lock = threading.Lock()
 
         self.session = requests.Session()
+        self.has_auth_token = bool(token)
         if token:
             self.session.auth = ('', token)
 
@@ -441,7 +442,7 @@ def list_repos(self, user=None, organization=None, pattern=None,
                             owner)
         elif user and not organization:
             owner = user
-            if include_private:
+            if include_private and self.has_auth_token:
                 # users/$name/repos does not include private repos, so
                 # we have to query for the repos owned by the current
                 # user instead.  This only works if the current token
diff --git a/tests.py b/tests.py
index 16e42e7..1545d9b 100644
--- a/tests.py
+++ b/tests.py
@@ -764,7 +764,7 @@ def Repo(name, **kwargs):
 
 def test_RepoWrangler_list_repos_for_user(mock_requests_get):
     mock_requests_get.update(mock_multi_page_api_responses(
-        url='https://api.github.com/user/repos?affiliation=owner',
+        url='https://api.github.com/users/test_user/repos',
         pages=[
             [
                 repo('xyzzy'),
@@ -798,7 +798,7 @@ def test_RepoWrangler_list_repos_for_org(mock_requests_get):
 
 def test_RepoWrangler_list_repos_filter_by_name(mock_requests_get):
     mock_requests_get.update(mock_multi_page_api_responses(
-        url='https://api.github.com/user/repos?affiliation=owner',
+        url='https://api.github.com/users/test_user/repos',
         pages=[
             [
                 repo('xyzzy'),
@@ -815,7 +815,7 @@ def test_RepoWrangler_list_repos_filter_by_name(mock_requests_get):
 
 def test_RepoWrangler_list_repos_filter_by_status(mock_requests_get):
     mock_requests_get.update(mock_multi_page_api_responses(
-        url='https://api.github.com/user/repos?affiliation=owner',
+        url='https://api.github.com/users/test_user/repos',
         pages=[
             [
                 repo('a', archived=True),
@@ -901,7 +901,7 @@ def test_RepoWrangler_list_repos_no_private(mock_requests_get):
 
 def test_RepoWrangler_list_repos_progress_bar(mock_requests_get):
     mock_requests_get.update(mock_multi_page_api_responses(
-        url='https://api.github.com/user/repos?affiliation=owner',
+        url='https://api.github.com/users/test_user/repos',
         pages=[
             [
                 repo('xyzzy'),
@@ -1374,22 +1374,22 @@ def test_main_no_org_gists(monkeypatch, capsys):
     )
 
 
-def test_main_run_error_handling(monkeypatch, capsys):
+def test_main_run_error_handling_with_private_token(monkeypatch, capsys):
     monkeypatch.setattr(sys, 'argv', [
-        'ghcloneall', '--user', 'mgedmin',
+        'ghcloneall', '--user', 'mgedmin', '--github-token', 'xyzzy',
     ])
     with pytest.raises(SystemExit) as ctx:
         ghcloneall.main()
     assert str(ctx.value) == (
-        'Failed to fetch https://api.github.com/user/repos?affiliation=owner'
-        '&sort=full_name&per_page=100:\n'
+        'Failed to fetch https://api.github.com/user/repos'
+        '?affiliation=owner&sort=full_name&per_page=100:\n'
         'not found'
     )
 
 
-def test_main_run_error_handling_no_private(monkeypatch, capsys):
+def test_main_run_error_handling_no_private_token(monkeypatch, capsys):
     monkeypatch.setattr(sys, 'argv', [
-        'ghcloneall', '--user', 'mgedmin', '--exclude-private',
+        'ghcloneall', '--user', 'mgedmin',
     ])
     with pytest.raises(SystemExit) as ctx:
         ghcloneall.main()
@@ -1405,7 +1405,7 @@ def test_main_run(monkeypatch, mock_requests_get, capsys):
         'ghcloneall', '--user', 'mgedmin', '--concurrency=1',
     ])
     mock_requests_get.update(mock_multi_page_api_responses(
-        url='https://api.github.com/user/repos?affiliation=owner',
+        url='https://api.github.com/users/mgedmin/repos',
         pages=[
             [
                 repo('ghcloneall'),
@@ -1428,7 +1428,7 @@ def test_main_run_start_from(monkeypatch, mock_requests_get, capsys):
         'ghcloneall', '--user', 'mgedmin', '--start-from', 'x',
     ])
     mock_requests_get.update(mock_multi_page_api_responses(
-        url='https://api.github.com/user/repos?affiliation=owner',
+        url='https://api.github.com/users/mgedmin/repos',
         pages=[
             [
                 repo('ghcloneall'),