When my users update their email address on the settings page of my application, I send them an email with a link to mydomain.com/verify_email?username=COGNITO_USERNAME&code=123456. When a user clicks on the link in the email, the user's default browser will open the specified page, which, in turn, will parse the URL and call Auth.verifyCurrentUserAttributeSubmit('email', code) (it does not use the search parameter username specified the URL).
However, this process only works if the user is authenticated, i.e. if the user's email client opens a browser tab or window on a device and browser where the user has previously signed in since any call to verifyCurrentUserAttributeSubmit needs to authenticated (see Amplify source).
How can I verify updated user attributes (preferably using Amplify) without requiring users to be signed in so that they can confirm updated attributes using another device or browser?