NGINX - allow access to specific URL only via a subdomain
Solution 1:
In your example.com server block, location ~ app { deny all; } (or similar):
server {
server_name example.com;
location ~ api { deny all; }
<configuration for example.com>
}
server {
server_name api.example.com;
<configuration for api.example.com>
}