Adyen: Missing or invalid clientKey/originKey (14_0381)

Adyen: Missing or invalid clientKey/originKey (14_0381)

TL;DR: The client key is wrong for the environment, or your checkout domain is not in the allowed origins. Generate a client key in the Customer Area for the environment you are running (TEST key on TEST), and add your exact domain to the allowed origins list.

14_0381 - Missing or invalid clientKey/originKey

Steps

1. Get the right client key. In the Customer Area, go to Developers > API credentials and copy the client key. TEST integrations need the TEST client key; LIVE needs the LIVE one. They are not interchangeable.

• Success check: the key's environment matches your integration's environment.

1. Allowlist your domain. In the same API credential settings, add your checkout domain to allowed origins, exactly as the browser sees it (scheme + host, no path).

• Success check: your domain appears verbatim in the allowed origins list.

1. Pass it to the SDK init. Feed the client key into your AdyenCheckout configuration on the frontend. A typo or a stale cached key fails the same way.

• Success check: the initialized checkout no longer throws 14_0381.

1. Native mobile note. iOS/Android SDKs use the client key but not origin allowlisting. If you see this on mobile, it is the key itself, not origins.

• Success check: mobile uses the plain client key for its environment.

When to use this

• Drop-in or Components fail to initialize with 14_0381.
• It works on one domain (or your dev machine through a tunnel) but not on another.

When NOT to use this

• API 401/403 errors. Those are about the secret API key on the backend, a different credential.
• 14_0382 (missing checkoutAttemptId). Different field, different fix.

Compatibility

Adyen Web Drop-in and Components, iOS and Android SDKs, TEST and LIVE.

Why it happens

The client key identifies your integration to Adyen's frontend services, and the origin check stops other sites from using your key. Wrong-env key, unlisted domain, or a key pasted with a typo all land on 14_0381.

Edge cases

• Single-page apps that deploy preview URLs per branch need each preview domain allowlisted, or a wildcard pattern if your setup allows it.
• Rotating the API credential can invalidate the client key too. After rotation, re-copy the client key, not just the secret key.