Our business is in the payment processing space and one of our core products is a Payment Gateway API. In terms of security we issue an API Key, Signature and RSA Encryption for sensitive information in the payload all over SSL. Customers are given an API key per E-Commerce website so we can route & tag their traffic accordingly before sending it to VISA/MasterCard.
That said, we are finding our larger clients to be an issue recently. VISA reached out to let us know that transactions are coming from other websites in a different industry and need to be routed to the correct account. Nothing illegal, just needs to be classified correctly. Long story short, we're finding that our larger clients are sometimes just using the same API Key for multiple websites that they own.