We have a large customer who wants to use a custom API integration into our Zoho ordering system to place orders rather than using a customer portal. We are currently using a custom order form in Zoho Creator that pushes through to Zoho Inventory. My concern is giving out our organization id to allow them to use an API, technically they would have access to all of our other customer information and orders. Support has said that there is no option that would allow them to be restricted to just their company number. 

Surely someone else has run into this issue before. What other solutions or workarounds have other people found for this?