hosting two applications on same domain using apache, one with basic authentication

Solution 1:

<Location /api> is not ignored, you just haven't configured the authentication for it, so the configuration from the higher level applies.

Disable AuthType for the location:

<Location /api>
    AuthType None
    Require all granted
    ProxyPass        http://localhost:90/
    ProxyPassReverse http://localhost:90/
</Location>