Nuget: access token for repository without anonymous access?

I am using a nuget repository without anonymous access. Following the "set me up" documentation on the artifactory front page, I entered my (encrypted) password into the local nuget.config file.

There are two problems with this approach:

• my CI servers need access to the repository, but I do not want to put my encrypted private password into either the repository or the CI server configuration, both of which is visible to others
• even if I'd be ok with the encrypted password, this does not work on docker because nuget does not support encrypted passwords on linux.

I know that artifactory has access tokens, but how do I specify a token in nuget.config?