OK, I've found a hokey solution (where My::Interface is the interface class generated by SOAP::WSDL):

my $service = My::Interface->new;
my $endpoint = $service->get_endpoint;
$endpoint =~ s!://!://$user:$pass@!;
$service->proxy($endpoint);
[download]

This inserts "$user:$pass@" after the "http(s)://". It's not nice, but it works in this instance, but it could be a bit brittle ...