It’s common for ad agencies like Ezoic to request access to your Website to troubleshoot ad issues.
Are the credentials encrypted? YES… But to be sure you need to create a separate account for them that only provides access to the official Website to avoid security risks.
After doing that please delete their account when they’re done.
Although I don’t work for Ezoic, this is a fairly common procedure. For AdThrive, I have a different account on my Wordpress blog. To optimize things, make adjustments to the ad layout, etc., they log in. If you are having problems, it’s not unusual for an advertising firm to want to come in and take a look around. You don’t have to. There would be no problem if I used the Ezoic dashboard to do it. I wouldn’t give them out by email or any other easily spoofable medium. I would go into what you believe to be Ezoic and give them access there.