import {
  Collection,
  CollectionConfig,
  generatePayloadCookie,
  headersWithCors,
  PayloadRequest,
} from 'payload'
...
endpoints: [
    {
      path: '/verified/login',
      method: 'post',
      handler: async (req: PayloadRequest) => {
        try {
          if (!req.json)
            return new Response('body is missing', {
              headers: headersWithCors({ headers: new Headers(), req }),
              status: 400,
            })

          const body = await req.json()

          const email = body.email ? body.email.toLowerCase().trim() : null
          const password = body.password

          if (!email || !password) {
            return new Response('email or password is missing', {
              headers: headersWithCors({ headers: new Headers(), req }),
              status: 400,
            })
          }

          const collection = req.payload.collections['users'] as Collection

          const user = await req.payload.find({
            collection: 'users',
            where: {
              email,
            },
          })

          if (user.docs.length === 0) {
            return new Response('invalid email or password', {
              headers: headersWithCors({ headers: new Headers(), req }),
              status: 401,
            })
          }

          if (!user.docs[0]._verified) {
            return new Response('email not verified', {
              headers: headersWithCors({ headers: new Headers(), req }),
              status: 401,
            })
          }

          const authResult = await req.payload.login({
            collection: 'users',
            data: {
              email,
              password,
            },
            req: req,
          })

          const cookie = generatePayloadCookie({
            collectionAuthConfig: collection.config.auth,
            cookiePrefix: req.payload.config.cookiePrefix,
            token: authResult.token ?? '',
          })

          if (!authResult) {
            return new Response('invalid email or password', {
              headers: headersWithCors({ headers: new Headers(), req }),
              status: 401,
            })
          }

          return new Response(JSON.stringify(authResult), {
            headers: headersWithCors({ headers: new Headers({ 'Set-Cookie': cookie }), req }),
            status: 200,
          })
        } catch (error: unknown) {
          return new Response('internal server error', {
            headers: headersWithCors({ headers: new Headers(), req }),
            status: 500,
          })
        }
      },
    },
  ],

AuthenticationError: The email or password provided is incorrect.

Email not verified. Please check your inbox to verify your email before logging in.