Scopes for API keys is an upcoming/under development feature:
but specific permissions for users on the dashboard/other CF accounts are only available on Enterprise accounts. You’ll either need to do things upon the developer’s request or give him full access to your account.
Another thing you could do is create a completely new account just to house the website, then add your main account and the developer’s account as ‘super admins’ so that you can both manage the domain, but then the developer could do anything they wanted to the domain.