Leiningen can use credentials for an artifact repository stored in a GPG-encrypted file. Make ~/.lein/credentials.clj, fill it with the following,

{#"url-to-match.com" {:username "username" :password "password"}}

encrypt it with gpg,

gpg --default-recipient-self -e \
    ~/.lein/credentials.clj > ~/.lein/credentials.clj.gpg

delete the original,

rm ~/.lein/credentials.clj

and then refer to it in your project.clj like this:

:repositories [["releases" {:url "https://url-to-match.com/repository/internal"
                            :creds :gpg}]
               ["snapshots" {:url "https://url-to-match.com/repository/snapshots"
                             :creds :gpg]]

https://github.com/technomancy/leiningen/blob/master/doc/DEPLOY.md#gpg

I had a bit of trouble at first connecting to gpg-agent, but solved it by putting this in my shell startup script (~/.zshrc for me):

gpg-agent --daemon --enable-ssh-support \
  --write-env-file "${HOME}/.gpg-agent-info"
if [ -f "${HOME}/.gpg-agent-info" ]; then
   . "${HOME}/.gpg-agent-info"
  export GPG_AGENT_INFO
  export SSH_AUTH_SOCK
  export SSH_AGENT_PID
fi

GPG_TTY=$(tty)
export GPG_TTY

https://gpgtools.tenderapp.com/discussions/problems/4133-how-do-i-automatically-start-gpg-agent-for-use-with-ssh