I'm not sure what you refer to by "password it returns".

But anyway, if you need to use key passphrase, you cannot just use session URL. It never contains key passphrase.

You have to edit the script to provide the passphrase using SessionOptions.PrivateKeyPassphrase.
https://winscp.net/eng/docs/library_sessionoptions#privatekeypassphrase

Or just remove the passphrase from the key.
You need to store the passphrase somewhere anyway to allow automation, what is as safe (irony) as unencrypted private key.

Better would be to use a Pageant
https://winscp.net/eng/docs/ui_pageant

See also
https://winscp.net/eng/docs/faq_passphrase

im connecting to a remote site via SFTP file where i pass my username and password - i've attached my private key and it prompts me for the private key pass phrase
and that's working ok everytime i connect.

I want to automate syncing the remote server down to my local windows box as there are jobs running 24/7 for the next six weeks and i want to get some sleep :-)

So i'm trying the Keep Local Directory uptodate script

i've gone and got the session url as it says and its come back with sftp://username:password;fingerprint=ssh-XXXXXXXXXXXXXXXXXXXX@myserver.TLD/ (sanitised of course)

however when I run the command i get an authentication error - i have noticed that the password it returns is not the actual password but rather the passphrase of the privatekey
could anybody help please