8

A private company allowed me to use their API to make REST API calls (using Basic Authentication) in my application's server side. They also asked to see my implementation before I can go live.

From their standpoint I understand they would like to make sure the API keys are secure enough.

From my standpoint I would prefer not to grant them access to my server side code or my github repo, but rather,like they asked, just show them how it was implemented.

What's the "normal" way of doing this / How can I achieve this without coming off as rude? We are communicating through email is it weird/rude/sketchy to just send over a .js file from my node.js server that shows them how it was implemented without them seeing it live or giving them access to my server/repo?

12

Email

Since they are only interested in the API, you do not need to grant them access to your source code repository. A simple email with a zip of the relevant source code would suffice. It is recommended that if you value the source code to make sure it is well labeled that you are the owner, and that the email is sent in a secure fashion (like encrypting the zip file and providing password separately). With that said what is 'normal' for companies when they can see the other company's source code:

Non Disclosure Agreement (NDA)

For companies the two parties sign a type of non disclosure agreement which in short protects the proprietary information of each group's part of the solution. If you want to help protect your code, I would recommend asking if they have a NDA agreement already created that you both could sign. Obviously be sure to read any agreement they provide to make sure it is not one sided, or if your code is sufficiently valuable to you, consult a lawyer to review the agreement.

  • An NDA agreement seems excessive and aggressive for them to only see parts of my code that are making calls to their API – garrettmac Jun 12 '16 at 0:04
  • Expanded my answer to make the answer a little bit less focused on NDAs. Note you do not need the NDA since you are not seeing their code, it is for them to agree to, in order to protect you. – Anketam Jun 12 '16 at 0:34
  • @Vyga there is nothing excessive nor aggressive about an NDA. For any company that's ever done any kind of dealings with other companies in terms of integration or product previewing this is all common. NDA's and safe harbor statements are so common we don't even blink at them anymore. – Mike McMahon Jun 12 '16 at 19:05
  • @Vyga In any business arrangement you need a legal contract an NDA is just one form and its benefit here is it is well known – user151019 Jun 13 '16 at 13:29
  • As a freelance software developer, I make any clients sign an NDA before even letting them breathe on the code. It's a quick process that typically takes 1-2 days for most people, and usually the wording involved is short enough for the average Joe to understand the document quickly. – Thebluefish Jun 13 '16 at 13:47
3

If your customer is close to you, you can propose an on-site audit. One of their engineers drops by, and you show them how you have organized security. In this way you don't have to grant them access rights to your server. In addition, you can directly address any questions the engineer might have. This kind of audits are extensively used, for example in security or food production.

0

Sending an archive of the pertinent code with the implementation is fine. I would not use hardcoded API keys, at the very least keep them in a secrets file and add it to your .gitignore. If you are worried about looking professional make sure to include a license either at the top as a comment or better yet in a separate license file and double check to make sure you comment anything they are looking at that may need to be explained.

0

Something that hasn't been covered or discussed is to simply send them an architectural diagram of how your code access these API key and secret. This should never exist in code nor should it be in git.

For example I use a Jenkins server that floats in required values at build time. This includes encrypted keys and secrets which are then decrypted and placed into secure areas on the server the code-behind can access.

In this scenario you really don't have anything you can "hand over" more than a diagram that shows the security that's been put in place around your code.

Further more they will likely want to sure that you are communicating via secure channels with their API so as long as they are SSL'd on their end you can make sure this is apparent in your diagrams.

This should help them feel secure in how your utilize and access their services. Short of a security review and them questioning how you harden your systems there isn't much else you can do (that I am familiar with given my exposure to enterprise security and contract negotiations)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.