Add a passive hardware token using a 3.5mm jack
Use 1-wire bus and any 1-wire chip inside the button. I wrote "any", because each 1-wire chip has its own, unique hardware address, so all that you need on RPi side is checking that the chip was detected, for example using bash command:

ls /sys/bus/w1/devices/


and checking it's output for existence of subdirectory named exactly as this hardware address.

On RPi HW side you need only connect additional jack socket to proper I/O pins (GND + DATA). There is no need to use any power connection here, so it looks to be safest for RPi than similar solution, which uses I2C (I2C needs to have dedicated power line, what makes risk of damage RPi in case of short-circuit).

EDIT: For reliable work you should add the pull-up resistor 4.7kOhm between DATA line and Vcc (3.3V).

You can use most popular and cheap DS18B20 chip, which additionaly provides possibility to measure the room temperature ;), or DS2401, which additionaly provides unique serial number.