Best way is to ask the kid to create a rachio account (or create one for him under a different email), and give that account (via it’s email address) a full access for the duration of the test. The kid will be able to access your controller & any others who share their access, via his (or secondary account you’ve created) account’s API key (you don’t have to give him yours). If you ever wish to revoke his access, simply remove his account from the list of users with whom you share full access.
If you’ve already shared your API, and wish to change it. You’ll have to contact Rachio support.
Giving someone full access and sharing API is essentially the same thing. To some degree, sharing your API is even worse as it potentially gives access to APIs normally not exposed via the full account sharing.