Brokerage wants my bank login info for verification

from your question and from your comments:

they wanted me to login after the transfer was complete to verify

and

to verify my bank account. Is this normal practice and safe?

In my experience when you want to link accounts that are in two financial institutions the general procedure to verify that you actually have control over the accounts is to do a pair of "micro" transactions. The sending bank will transfer two small amounts of money, and then reverse the transactions. They then give you a business day or two to verify the amounts transferred. You tell them the amounts they transferred.

The banking system allows them to reverse the exact transactions if they initiate the reversal within a few days of the transfer. This procedure allows them to make sure that you can log into the other account and verify the amounts.

In the last few years my family has had to do this for a brokerage, a bank, a credit union, and an employer.

There isn't a requirement to check the transaction history via the sending institutions website. They don't care if you check via browser, phone, or asking the teller for a printout. They just want you to go onto the sending institutions website and enter the amount of each transaction.

Is this normal practice and safe?

In my experience in the USA, yes this practice is normal. However, be very careful when you do this.

As you said, the bank offers two options.

1. Verification of small deposits (often called "manual" verification)
2. Verification through bank login details (often labeled "instant" verification)

Both of these methods are "safe" if they are done by a legitimate, scrupulous, company.

Method 1 usually entails the company make one or two small deposits less than $1 in total. Once those deposits hit your account, you login to the company (in this case the brokerage) website and tell them the amount of the deposits. If the amounts match what was actually deposited, the bank account is verified for transfers. The brokerage will usually reverse the deposits within a week.

Method 2 usually uses some sort of third party API like Plaid. This API uses your login credentials for a one-time login to verify the account. Many legitimate companies/apps use this method such as Mint (owned by Intuit), YNAB, Cashapp, and others.

Method 1 requires that you give them your account and routing numbers. Method 2 requires that you provide your username and password for a one-time login. In either case, only provide this info to companies you know and trust 100%. There is a very real threat that a scammer could use either to steal your money. Although, Method 2 is arguably more invasive and could lead to much more money being taken directly from your bank account.

As a matter of security, I always use Method 1 when I can. Giving account numbers is much safer (read as: "not as bad") than giving my bank login details. The "instant" verification of Method 2 is not worth the extra exposure of my information. Note that many banks will not cover you for fraud if you give your login details out to anyone. Some banks do the opposite and knowingly participate and allow these third-party APIs to work with their accounts.

If a company only offers Method 2, and you are unsure about their legitimacy or security, do not give them your details. It is always safer to er on the side of "I'd rather keep my identity safe than have this account".