What's the simplest way to associate a user account on a 3rd party site with a StackExchange user account?

Question

I'm not asking about associating Stack* accounts with one another.

If I have a 3rd party website and I want my users to be able to link to their StackExchange/StackOverflow user accounts, but I don't want users to be able to link to accounts that aren't theirs, what is the best way to achieve this? That is, how can I confirm that a given user on my website really does correspond with a given Stack* user?

Some options I've considered:

1. User's display name must match (not very secure, but something)
2. Ask user to update their profile with some random token string, similar to how Google Analytics asks for a CName record or file on a website
3. Use OpenId and have the user log into my website using their SO OpenId

What's the simplest, best option? I'd like to be able to give the user some kind of rewards specific to activities they do on StackOverflow that I value (separate from SO badges), but I don't want users to be able to cheat by associating with somebody else's SO account. Hence, the goal of validating the account is actually theirs.

Thanks for your help!

Answer 1

You should use the OAuth 2.0 functionality built into the Stack Exchange API. It's not technically the easiest option in comparison to the three you listed, but the ones you've suggested don't sound like they'd be particularly effective in enforcing your requirements either.