Ultimately you are responsible for any activity on your api key so ifthey use it you are responsible.
I would be reluctant to give them the API key personally, if for anyreason they needed to test they could get their own.