Only allow a clientId || apiKey, never both.

When a Client ID is set, prefer it over an API key.