I'm trying to exclude the API route "https://example.com/api/" from the Nginx HTTP Basic Authentication.

Here is my Nginx Conf:

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    return 302 https://$server_name$request_uri;
}

server {

    # SSL configuration

    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl_certificate         /etc/nginx/ssl/cert.crt;
    ssl_certificate_key     /etc/nginx/ssl/key.pem;
    ssl_client_certificate  /etc/nginx/ssl/cloudflare.crt;
    ssl_verify_client on;

    server_name example.com;
    root /var/www/mysite;

    index app.php index.php;

    location / {
        try_files $uri $uri/ /app.php$is_args$args;

        # Restricting Access
        auth_basic 'Administrator Area';
        auth_basic_user_file /etc/apache2/.htpasswd;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
    }

    # Restriction off for api
    location ^~ /api/ {        
        auth_basic off;
        allow all;
    }

}

But when I try to hit "https://example.com/api/" on the browser, it's still asking for basic authentication. Usually, without basic authentication, it should provide a JSON response on the browser.

Does anyone know how to solve this issue? Any kind of help would be greatly appreciated. Thanks.