When using Pontoon to translate a private repository, it still expects the l10n.toml file to be publicly downloadable over http protocol (e.g. raw github link).
Not an answer to your question, but if you’re using .po files to translate all locales in the same way (based on your previous post), you don’t need a TOML file at all. The TOML file is needed only for multiple files, each one assigned to different sets of locales.
The way the standard makemessages command works in django is that it creates a .po file for each locale in a separate directory. I could be wrong but I think I do need a toml file in this case to assign the .pot file as the source and the .po files as l10n files
That field in the Pontoon project is set up as https://raw.githubusercontent.com/mozilla/fxa-content-server-l10n/master/locale/{locale_code}. That’s only used to download files, so it shouldn’t matter if the repository is private.
With that said, the question is still relevant: is it possible to use a TOML file in a private project?