Approach to create headless drupal with login
I'd recommend you look at OAuth 2.0, which more or less standardizes the process of how to get to a valid login state/token.

I used https://www.drupal.org/project/simple_oauth recently in a project, which depends on the oauth2 component of the phpleague, which comes with great documentation: https://oauth2.thephpleague.com/. And the module itself also has a lot of documentation and whole video series on how to configure and use it.

OAuth2 provides 5 different ways to handle what it calls a grant, based on whether your client is an API, another website, a 3rd/1st-party client and so on: https://oauth2.thephpleague.com/authorization-server/which-grant/

E.g if you're OK with the user entering his password then you can just use the password grant, if you don't want that, you can use the oauth/authorize page which then redirects the user back to the app and so on.