How can I securely protect my Next.js /admin page login system?

/api/admin/login

import { NextRequest, NextResponse } from "next/server";

export async function POST(request: NextRequest) {
  const { username, password } = await request.json();
  if (
    username === process.env.ADMIN_USER &&
    password === process.env.ADMIN_PASS
  ) {
    const res = NextResponse.json({ success: true });
    res.cookies.set("admin-auth", "true", {
      httpOnly: true,
      secure: process.env.NODE_ENV === "production",
      sameSite: "strict",
      maxAge: 2 * 24 * 60 * 60, // 2 days
    });
    return res;
  }
  return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
}

document.cookie = "admin-auth=true";