How best to authenticate users for a website that sells event tickets?

Without some vague hints as to your threat model, noone is in a position to contribute usefully.

Failing that, the best way to

Identify: "I am Bob"

Authenticate: "I am Bob, honest!"