When setting up the API key, use the "Select zones to include or exclude." section. Works fine on the free account.

I should have clarified, you can’t for subdomains on a non-enterprise account.