[Dolgubon]

You may not need to make it impossible to spoof an account. Just make it difficult. If you have them go to a URL then use the hash of the display name (if you can figure out the ZOS hashString). Maybe some other stuff as well. Make your code more complex, so that someone trying to spoof needs to understand Lua very well. It won't be perfect, but you'll still manage to stop the vast majority of players who try.

If you want more foolproof, then I think guild applications would be the way to go. Create a dummy guild, have users apply to it for verification and request verification on the website. Then the website generates a Lua file for you with a list of the names, and a personal add-on can flag any that didn't apply.


Or maybe crowdsource it - want to get verified? You need to get verified by another user (or two)