This caused me a lot of confusion; Phabricator returns a 403 when you try to pull down an inactive repository, and no matter whether you get the credentials correct, you basically get access denied.
Either Phabricator should allow pulling from Inactive repositories (I see no reason to prevent pulls, but preventing pushes is probably reasonable), or the error should be much more clear (and not a 403).