A private company allowed me to use their API to make REST API calls (using Basic Authentication) in my application's server side. They also asked to see my implementation before I can go live.
From their standpoint I understand they would like to make sure the API keys are secure enough.
From my standpoint I would prefer not to grant them access to my server side code or my github repo, but rather,like they asked, just show them how it was implemented.
What's the "normal" way of doing this / How can I achieve this without coming off as rude? We are communicating through email is it weird/rude/sketchy to just send over a .js file from my node.js server that shows them how it was implemented without them seeing it live or giving them access to my server/repo?