the error:
Security header is not valid
means that you API Credentials are not being accepted.
you may be using live credentials and accessing the sand box server, or vice versa. Also make sure that you have accepted the billing agreement after requesting the API credentials.