diff --git a/lib/config.js b/lib/config.js
index 7eea2ea..eaef014 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -34,6 +34,11 @@ function validateConfig(config) {
   const hasSvcAccounts = Array.isArray(config.serviceAccounts) && config.serviceAccounts.length > 0;
   const hasCredPath = !!config.credentialsPath;
 
+  // Do not allow both API keys and service accounts to be present simultaneously
+  if (hasApiKeys && hasSvcAccounts) {
+    throw new Error('Configuration must not include both `apiKeys` and `serviceAccounts`; choose one authentication method');
+  }
+
   if (!hasApiKeys && !hasSvcAccounts && !hasCredPath) {
     throw new Error('Configuration must include at least one of: `apiKeys`, `serviceAccounts`, or `credentialsPath`');
   }