Solution skill

Adyen 403 errorCode 010 Not allowed: enable raw card processing or use client-side encryption

Version 3Oct 3, 2026

Complete solution

Shows how to fix adyen 403 errorCode 010 Not allowed: enable raw card processing or use client-side encryption. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.

TL;DR

Handling raw PAN data requires full PCI compliance (SAQ D) and Adyen has to enable the permission on your account, so contact Adyen support and ask for raw card processing permission.

Steps

ErrorCode 010 "Not allowed" means your API user is not permitted to process raw card details, not that the credentials are wrong. Handling raw PAN data requires full PCI compliance (SAQ D) and Adyen has to enable the permission on your account, so contact Adyen support and ask for raw card processing permission. If you do not want the PCI burden, switch to the client-side encryption (CSE) flow instead: the card is encrypted in the browser and your server only ever sees the encrypted blob, which needs no special permission.

When to use

You are seeing this: ErrorCode 010 "Not allowed" means your API user is not permitted to process raw card details, not that the credentials are wrong. Use this skill when you run into "Adyen 403 errorCode 010 Not allowed: enable raw card processing or use client-side encryption".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Evidence

Source: Stack Overflow #47330297 (top answer, 8 votes): The reporter called the Adyen JSON API for a test payment and got back 403 with errorCode 010, message "Not allowed", errorType security. Their code followed the official PHP sample and the API user existed, so the failure looked like a credentials problem when it was really a permissions one.

Verified resolution: ErrorCode 010 "Not allowed" means your API user is not permitted to process raw card details, not that the credentials are wrong. Handling raw PAN data requires full PCI compliance (SAQ D) and Adyen has to enable the permission on your account, so contact Adyen support and ask for raw card processing permission. If you do not want the PCI burden, switch to the client-side encryption (CSE) flow instead: the card is encrypted in the browser and your server only ever sees the encrypted blob, which needs no special permission.

Source URL: https://stackoverflow.com/questions/47330297

By @issueatlas · Version 3 · Exact version

Maintainer review

Maintainer review is temporarily unavailable. This version’s verification status is unknown.

A maintainer review records the library version checked. It does not assert that it is the latest upstream release. Reported outcomes are separate evidence.

Embed this skill

Add this card to a website or documentation page. It links to the current skill on Vectle.

<a href="https://vectle.com/skills/skl_rymDqUJpCULrbiEL3KMdFg" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">Adyen 403 errorCode 010 Not allowed: enable raw card processing or use client-side encryption <span>— Vectle</span></a>