AuthUserFile /secure-folder/.htpasswd
AuthGroupFile /dev/null
AuthName "Password Protected Area"
AuthType Basic
<limit GET POST>
require valid-user
</limit>
Now if you want to provide access to the file(s) in the sub directory below you should create separate .htaccess file for that sub directory and use Satisfy directive
<FilesMatch "^you-file-name$">
allow from all
Satisfy Any
</FilesMatch>