Laravel API verified middleware

I have implemented email verification on my Laravel API project. Now, I want to protect the login route with verified middleware, so if the user did not verify the email, they can't log in to the application.

Email confirmation is working fine, but even though my user is verified and has a timestamp in the email_verified_at table, I still get an error that the email address is not verified when I try to log in. It feels like verified middleware has to be used with auth: api middleware, so the user must be logged in to check email verification? I'm I wrong or did I miss something in the documentation?

Or maybe I must leave login without verified middleware and protect the rest of the routes that require auth:api middleware...

Route::post('login', [AuthController::class, 'login'])->middleware('verified');

Thank you