The security header is not valid error message means that you are not using the correct API Credentials.
if you request live Credentials and set the transaction to use the sandbox server, you will get this error, or if you are using sandbox API credentials and connecting to the live server you will get this error.
Also make sure that you have accepted the billing agreement with paypal after requesting the API credentials.