In regards to your proposed workflow, I would prefer to have "the API" use a webhook to let the App know that the email has been verified.
This way I can update a user record and make a nicer experience the next time the user comes back rather than having to make a call to the API to check they are verified.
This way I can update a user record and make a nicer experience the next time the user comes back rather than having to make a call to the API to check they are verified.