This isn't an answer about how to program it yourself, so I apologise if I come off as unhelpful, but one thing I've had drilled into me over and over again by people who specialise in solving problems like this is get someone else to do it. You're right, the simplest possible implementation is not secure. All the specific things you need to do to make it secure are a whole application, perhaps a whole career, in themselves. If your project is to make a web application, then you're probably good at making web applications, and that's what you'd like to be doing - so why not let someone who likes making secure authentication take care of this part for you, so you can get back to working on your own application logic?
My understanding is that this is one of the key reasons JWTs were invented - to facilitate the offloading of authentication to a third party. Your app presents the mechanism for the user to securely send their authentication info to their own well-secured server; the third party server then does all the work, and returns the token which your site takes to mean "this user is authenticated". This way, you don't need to worry about securing users' secrets from outside threats, and you don't need to worry (as much) about every possible security error in your code that could compromise your own application, either. Specialisation is one of the most important parts of a highly industrialised society - you don't feel obliged to install the wiring in your own datacentre, or increasingly even to own and maintain your own physical servers, because you're interested in writing web applications. You should maybe consider taking the same approach to authentication.
EDIT: I may have misunderstood - if by "calling API routes" you actually mean interacting with one of these third party authentication providers, then my advice is totally redundant. Even so, I can't imagine any authentication provider (or their API, or the module they provide to integrate their service into your app) sending anything in the clear. The whole idea is that they take responsibility for the users secrets. Their job is to make using their service as easy and secure as possible for you and your users.