How can I verify users the first time they log in?
Log in to Drupal by POSTing the user credentials. Make sure you set the "Content-Type" header. This starts the user's session.

POST URL:

/user/login?_format=json


Header:

Content-Type: application/json


POST data:

{
  "name": "username",
  "pass": "password"
}


Successful response:

{
  "current_user":{
    "uid": "1",
    "roles":[
      "authenticated",
      "administrator"
    ],
    "name": "username"
  },
  "csrf_token":   "asda09820380_2238019280dk09n908asjdlkajdaoa",
  "logout_token": "asdasd09a8sdaslkdasl-asdasdklsajdlkasdjlksj"
}


Use the CSRF token in subsequent GET, POST, PATCH, DELETE etc. requests by setting the header:

X-CSRF-Token: asda09820380_2238019280dk09n908asjdlkajdaoa


To log out, use the logout token in a POST request. This ends the user's session.

/user/logout?_format=json&amp;token=asdasd09a8sdaslkdasl-asdasdklsajdlkasdjlksj


GET login status:

/user/login_status?_format=json


GET token:

/rest/session/token


References: 


JavaScript and Drupal 8 RESTful Web Services
Change record: Additional RPC endpoints: user/login user/login/status user/logout user/password/reset