delete

[subwoofer12]

delete

[Automatic]

Never used coinbase, but, they should have a developer page, it'll tell you all the permissions an API key can have.

[crunchynut]

 https://coinbase.com/docs/api/authentication

API key authentication grants full access to an account, so it should be used with caution (see security notes below).

[DeathAndTaxes]

I would create a new temporary account and give him that key.  Otherwise ensure that you can revoke the key and generate a new one.  Once the developer knows the key you can't make him unknow it.  He could simply wait until someday in the future when the account holds a thousand BTC and remove them instantly.