that risk can be mitigated by having the API customer (say, an iPhone app developer) buy API credits that are exchanged at the time of API call between the app and picplum. Then it's the app developer's job to collect payment from their app user and PicPlum won't get burned.

Or when a user signs up for our app we have them sign up for Picplum in the background, when they buy credits it goes through picplum in the background and the same for when they use the credits?

It'd be best to be transparent about that handoff rather than just silently doing it in the background, but yeah, that would also work.