Ok I guess I found the solution for my problem. Posting it here in case someone else will have similar problems.
I needed ^~ right before /api/. But that is not enough. Then the API is not password protected anymore. The protection is back with the lines auth_basic and auth_basic_user_file...
Hey everyone,
I need some help with the following setup:
a docker container running my API
a website which is public
a 2nd website which is protected with password (via Protected Directories)
On the public website I set up following additional rule for nginx:
location /api/ {...