.htaccess redirect only if ip address is not listed or not a specific url

Question

I'm trying to setup a staging subdomain and only want to allow access to certain ip addresses, but allow everyone access to any url starting /api.

What I have below works for the ip address, but always redirects if I try and access for example /api/projects or /api/users with an ip address not listed.

Any help would be greatly appreciated.

RewriteEngine On
RewriteBase /

RewriteCond %{REMOTE_HOST} !^11\.11\.11\.11
RewriteCond %{REQUEST_URI} !/api*
RewriteRule ^.*$ http://domain/ [R=302,L]

RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]

Answer 1

You can put a separate .htaccess file inside /api/foo

Your .htaccess file might look like so:-

order deny,allow
deny from all
allow from 1.2.3.4
allow from 2.3.4.5