Hello Long & Jana,
The API Credentials, that your developer is asking you for, are essentially the login credentials so that any API call made with them, is known to be yours.
By default:
No one should have either of them except yourself, because those are login credentials like your email address and password.
If your developer is in house and part of your company, then maybe, but external developers, that be unwise.
That being said, in order to make API calls, the integration, aka your shop, has to send them to us.
To maintain security over those credentials, the following is usually being done:
# Scenario A - 3rd Party API Caller
If your developer/partner/provider is doing API calls for you, some shopping carts do that, then you can grand them access to certain functions of your account (create transactions, execute transactions, lookup transactions, refunds, reports, withdraw money etc.). You select what they have access to and its best to give them what is needed but not more.
The documentation on how that is done, can be found here https://developer.paypal.com/docs/admin/third-party/
# Scenario B - Developer is creating the shop and handing it over to you later
Let them prepare everything against the sandbox, so the live credentials are not needed and they can use their own sandbox accounts.
During the handoff, have them show you where to enter the credentials in the backend, do that then.
I hope this helps,
Stefan
