Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I'm not asking about associating Stack* accounts with one another.

If I have a 3rd party website and I want my users to be able to link to their StackExchange/StackOverflow user accounts, but I don't want users to be able to link to accounts that aren't theirs, what is the best way to achieve this? That is, how can I confirm that a given user on my website really does correspond with a given Stack* user?

Some options I've considered:

  1. User's display name must match (not very secure, but something)
  2. Ask user to update their profile with some random token string, similar to how Google Analytics asks for a CName record or file on a website
  3. Use OpenId and have the user log into my website using their SO OpenId

What's the simplest, best option? I'd like to be able to give the user some kind of rewards specific to activities they do on StackOverflow that I value (separate from SO badges), but I don't want users to be able to cheat by associating with somebody else's SO account. Hence, the goal of validating the account is actually theirs.

Thanks for your help!

share|improve this question

You should use the OAuth 2.0 functionality built into the Stack Exchange API. It's not technically the easiest option in comparison to the three you listed, but the ones you've suggested don't sound like they'd be particularly effective in enforcing your requirements either.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .