A private company allowed me to use their API to make REST API calls (using Basic Authentication) in my application's server side. They also asked to see my implementation before I can go live.
From their standpoint I understand they would like to make sure the API keys are secure enough.
From my standpoint I would prefer not to grant them access to my server side code or my GitHub repo, but rather, like they asked, just show them how it was implemented.
What's the "normal" way of doing this? How can I achieve this without coming off as rude?
We are communicating through email; is it out of line to just send over a .js file from my node.js server that shows them how it was implemented, without them seeing it live or having access to my server/repo?
I understand this question is similar to Hand over source code to customer and Freelancing - Share the source code? but they don't seem to answer my question.