Comment by jmuguy

They ought to at least understand that Stripe Connect and OAuth can be used rather than literally giving them your API keys.