It asks for API credentials because it uses the saved buttons functionality of paypal, not standard form payment buttons.
This means your button information is stored and retrieved from the paypal website... which necessitates API credentials.
It is completely legitimate, secure, and supported by Paypal. Read more about it here: e_howto_api_ButtonMgrAPIIntro