Options -Indexes
RewriteEngine On
RewriteBase /api/

<FilesMatch "^(config\.php|db\.php|auth\.php)$">
  Require all denied
</FilesMatch>

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L,QSA]
