One easy way to do that is to set up something like Nginx as a reverse proxy in front and forward /api clean, but forward everything else with basic auth.

The steps broadly would be:

• Set up an Nginx instance
• Set up a block in Nginx to proxy / to your Lemmy instance
• Set up basic auth on that block
• Set up a smaller block that will only proxy calls to /api and other endpoints you want public, like previously with /
• Make your Lemmy instance unreachable from the broader internet, eg. if you’re on a single server, make it listen on 127.0.0.1 instead of 0.0.0.0, but make sure Nginx can still reach it

And you’re done.