Unfortunately I can't comment on @jon-lin answer. So, I create a new answer. My adapted solution in an apache 2.4 environment is:
## password protect /pretty/url URIs#AuthType BasicAuthName 'Authentication required'AuthUserFile /path/to/.htpasswd# Restrict access to some urlsSetEnvIf Request_URI ^/pretty/url auth=1<RequireAll> # require the auth variable to be set Require env auth # require an valid-user Require valid-user</RequireAll>