hosting two applications on same domain using apache, one with basic authentication
Solution 1:
<Location /api>
is not ignored, you just haven't configured the authentication for it, so the configuration from the higher level applies.
Disable AuthType
for the location:
<Location /api>
AuthType None
Require all granted
ProxyPass http://localhost:90/
ProxyPassReverse http://localhost:90/
</Location>