PayPal API Secret key security

The developer of my web site asked me for the Client ID and Secret Key to integrate the PayPal Payment. My Question is: If I provide these credentials can they withdraw funds from my account?

API credentials cannot be used to withdraw funds, unless both of the following are true

• You have contacted PayPal to request the Mass Pay / Payouts feature be enabled for your live PayPal business account. This is rare, approval and the feature enablement is only granted for specific business needs to pay out money.
• The REST App that client id/secret correspond to also have the "Payouts" permission checked in the App settings. This is checked by default under "Other features", so if you are paranoid just uncheck it and save, then send them the client id and secret.