What you really want to understand is the URI syntax. Note that a URI (You-Are-Eye) is NOT the same as a URL (You-Are-Ell). All URL's are URI's, but not all URI's are URL's.
Please see the Wiki article https://wikipedia.org/wiki/Uniform_Resource_Identifier or the IETF RFC https://datatracker.ietf.org/doc/html/rfc3986 about URI's.
In general, for a sftp URI (in this case, the same as a URL), the format is:
"sftp:" [ "//" [ <user-part> "@" ] <host-part> ] <path-part>
Where the <user-part> can be further sub-divided:
<user-name> [ ":" <user-password> ]
In general, however, using such a URI/URL is strongly discouraged, as both the user name and password are plainly visible to anyone snooping network traffic outside of the secured end points. That "window of opportunity" may be very small in a well-written application, or it may be comparatively large if the application "hands it off" to another application to handle the establishing the actual secure connection between end points.