The security Header is invalid message means that there is a problem with the ap[i credentials you are using. It could be a few things:
You could be using Tesat API Credentials, but it is set to process through the live server, or vice versa.
This error can also happen if you do not except the PayPaL billing agreement.
Sometimes the API Credentials can just be bad, you may want to try requesting new API Credentials.