Any way to verify the owner of a character?

I'm not asking for people to log in or anything like that, but if users could go to Battle.net and get an API token, and then character data from the API would include some sort of encrypted string that can only be decoded with the owner's API token, that would give sites a way to verify ownership of a character.

Another way of doing it is to pass an optional header including the API token (as explained above) and get a list of characters owned by that account.