I'm another developer on Dirigible. We already have module upload on our roadmap. We know what we need to do to implement is and all the hard work to prevent cross-sharing of modules between users is already done.

The API is secured with a key that is unique to each spreadsheet and it can be easily regenerated if necessary. Do you have other restrictions that would be interesting to you?

Can I generate multiple api keys to control customer access?

Not yet, but soon.