when use ref(), you better use it with single string data , not an object. If you insist , try reactive()
in your login logic
first get the csrf token by hitting
const csrfResponse = await axios.get('/sanctum/csrf-cookie')
this will return a response of csrf token which should pass with an X-XSRF-TOKEN header in axios
so , in your login function this should be
const loginResponse = await axios.post('/login', {
email: form.value.email,
password: form.value.password
}, {
headers: {
'X-CSRF-TOKEN': csrfResponse.data, // whatever contains the csrf token data, you can find it
},
})