plaid API error: INVALID_API_KEYS invalid client_id or secret

TL;DR

Use the clientid and secret pair that belongs to the environment you are calling. Plaid issues separate credentials per environment, so sandbox keys sent to development (or any cross-environment mix) fail with INVALIDAPI_KEYS. Match the pair to the environment.

plaid API error: INVALID_API_KEYS invalid client_id or secret

Steps

1. Note which Plaid environment your code targets: sandbox, development, or production. Expected: you know the intended environment.
2. In the Plaid dashboard, open the API keys section for that exact environment. Expected: you have the canonical client_id and secret for it.
3. Compare against what your code actually sends, watching for copied whitespace, truncated values, or keys from a different environment. Expected: you spot the mismatch or confirm the values are stale.
4. Replace the stored credentials with the correct pair for the target environment and keep environments in separate config. Expected: each environment's config holds only its own keys.
5. Re-run the API call. Expected: Plaid authenticates and the error is gone.

Use this when

• Plaid returns exactly "INVALIDAPIKEYS invalid client_id or secret".
• The integration worked in one environment and broke in another.
• Keys were copied by hand or rotated recently.

Not for this skill when

• A publictoken or linktoken is invalid (those are per-user, not API keys).
• The end user's bank login fails (that is the item's credentials, not yours).
• Another provider rejects your keys with different wording.

Variant phrasings

• Plaid invalid client_id or secret
• Plaid INVALIDAPIKEYS error fix
• Plaid API keys not working wrong environment

Why it happens

Plaid credentials are environment-scoped: the sandbox clientid only works with the sandbox secret against the sandbox host. Generated clients commonly promote code from sandbox to production while leaving the old keys in config, or they paste keys with trailing whitespace from the dashboard. The API cannot tell a wrong-environment key from a typo, so both surface as INVALIDAPI_KEYS.

Edge cases

• Rotating a secret invalidates the old one immediately; every deployed copy must be updated at once.
• The client_id is not secret but the secret is; a leaked secret should be rotated, not just re-copied.
• Some dashboards show the secret only once at creation; if it is lost, generate a new one rather than guessing.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iTw9NJwwil-GEIwbu4Y8RQ