PayPal 'Security Header Is Not Valid' Error Fix

PayPal error 10002, 'Security header is not valid', means PayPal rejected the API credentials your store sent, so the fix is to re-check the API username, password and signature, make sure sandbox and live keys are not mixed, remove stray spaces, and regenerate the keys if they still fail.

This post is for store owners who see the error at checkout and want it gone quickly. You will get a short checklist, numbered steps you can follow in about 15 minutes, and an explanation of why this error has nothing to do with website security headers. You do not need to be technical.

What does 'security header is not valid' mean in PayPal?

It is a login failure between your store and PayPal. Your shop software (WooCommerce, Magento, a custom site, or an older plugin) sends three secrets to PayPal's classic API: an API username, an API password, and an API signature. If PayPal does not accept them, it returns error code 10002 with the message 'Security header is not valid'. Some tools show 'Authentication/Authorization Failed' for the same code.

Error 10002 is shared by several authentication and permission messages, so the exact message text matters. It can cover bad credentials, a missing API permission, or a locked or restricted account. If your message is not 'Security header is not valid', this post still applies.

An API (application programming interface) is just the way two systems talk to each other. Think of the three values as a username and password for your store's connection to PayPal. The 'security header' in the message refers to the block of credentials in that request. PayPal documents its classic NVP/SOAP interface in its developer documentation.

Is this the same as HTTP security headers?

No. This is the part that confuses many people. The words 'security header' sound like the browser protections called HTTP security headers, such as Content-Security-Policy or Strict-Transport-Security. Those are settings your web server sends to visitors' browsers. You can read about them in the OWASP Secure Headers Project.

PayPal error 10002 is a different thing that happens to share a name. Changing your site's HTTP headers will not fix it, and fixing this error will not change your header score. If you are curious about the real ones, our security headers tool shows what your site sends.

Quick checklist: the usual causes

Most 10002 errors come from one of the causes below. Start at the top.

Step-by-step fix for error 10002

1. Decide whether you are in live or sandbox mode

PayPal has two separate worlds. Live moves real money. Sandbox is a practice environment with fake accounts. Their keys do not work in each other's world.

Open your plugin's PayPal settings and find a setting called 'Sandbox', 'Test mode' or 'Environment'. For a real store taking real orders, sandbox should be off. If you are testing, it should be on, and you must use sandbox keys from your PayPal Developer account.

2. Open your API credentials in PayPal

Log in to the live PayPal Business account that receives your payments. Menu names change from time to time, but the path is usually:

1. Click the gear icon (Account Settings).
2. Go to Account access (older layouts say Profile and Settings, then My selling tools).
3. Find API access and click Update.
4. Choose NVP/SOAP API integration (Classic) and click Manage API credentials.

You will see an API username, password and signature. Use the signature type, not the certificate type, unless your software specifically asks for a certificate.

3. Copy each value cleanly and remove stray spaces

The most common cause of a 'bad' key is an invisible space at the start or end. Paste each value into a plain text editor first. Check that nothing sits before or after it, then copy it again from there.

Watch for these traps:

• A trailing space picked up when you double-clicked the value.
• A line break if the signature wrapped onto two lines.
• Look-alike characters, like a capital 'O' and zero.
• Smart quotes or extra characters added by an email or chat app.

4. Paste the values into the right fields

Put the username in the username field, the password in the password field, and the signature in the signature field. Swapping them is easy to do, because all three look like random text. Save the settings.

5. Regenerate the credentials if it still fails

On the same PayPal page, you can request new API credentials or remove and re-create them. Then paste the new values into your store. Regenerating makes the old values stop working, so only do this when you can update every system that uses them (your store, any invoicing tool, any other site on the same account). If you are not sure who else uses the keys, ask first.

6. Check the account itself

Classic API credentials are tied to a PayPal Business account. If you cannot find API access at all, your account may be a personal one, may not be fully verified, or may have limits. PayPal's help pages explain what your account type allows. If the account is restricted, no key will work until PayPal clears it.

7. Place a test order

Make a small real purchase, or a sandbox purchase if you are in test mode. If checkout completes, you are done. Refund yourself afterward if it was a real charge.

Fixing it in common platforms

Where you paste the keys depends on your setup:

• WooCommerce: go to WooCommerce, then Settings, then Payments, open your PayPal method, and look for API username, API password and API signature. If the plugin you use is old, PayPal's current WooCommerce plugin (PayPal Payments) connects through a login flow instead of these three values, so there is nothing to mistype.
• Magento and other carts: look in the payment method settings for 'API Username', 'API Password' and 'API Signature'.
• Custom or agency-built sites: the keys are usually in a settings page or a configuration file. Ask your developer where, and never email the values in plain text.

Optional: test the credentials outside your store

If you are comfortable with a terminal, you can ask PayPal directly. This sends a read-only balance request to the live signature endpoint. Run it on your own computer, replace the three placeholders, and do not paste real keys into shared chats or tickets. The command uses --data-urlencode for the three secrets, so a value containing &, + or % is sent intact and does not cause a false 10002.

curl -s https://api-3t.paypal.com/nvp \
  --data-urlencode USER='YOUR_API_USERNAME' \
  --data-urlencode PWD='YOUR_API_PASSWORD' \
  --data-urlencode SIGNATURE='YOUR_API_SIGNATURE' \
  -d METHOD=GetBalance \
  -d VERSION=204.0

If the reply contains L_ERRORCODE0=10002, read L_LONGMESSAGE0. A message like "Security header is not valid" or "Authentication/Authorization Failed" means PayPal is rejecting the credentials, so go back to steps 1 to 5. A message like "You do not have permissions to make this API call" suggests the credentials may have been recognized but the account or its API permissions need attention, so go to step 6. If the reply says ACK=Success, the keys are fine and the problem is how your store is using them.

Note that error 10002 is a broad code. PayPal also uses it for messages such as "You do not have permissions to make this API call" or "Authentication/Authorization Failed", so read the L_LONGMESSAGE0 text, not just the number. A different error code, or a 10002 permissions message, suggests the credentials may have been recognized but something else needs attention.

For sandbox keys, use https://api-3t.sandbox.paypal.com/nvp instead. Because the command can land in your shell history, consider regenerating the keys if you ran it on a shared machine.

If it still fails

Work through these quick checks:

• Clear any caching plugin or server cache, then retry checkout.
• Confirm the plugin is updated and supports the credential type you are using.
• Make sure only one PayPal plugin is active, since two can fight over settings.
• Check that you are editing the right site if you have a staging copy and a live copy.
• Look at your store's logs. WooCommerce keeps them under WooCommerce, then Status, then Logs.

If PayPal support confirms the credentials are valid and the error continues, the problem is in the plugin or the server, and that is a job for your developer or host.

Keep your PayPal keys safe

API credentials are secrets. Anyone who has them can ask PayPal to act on your account within the permissions granted. The OWASP Secrets Management Cheat Sheet covers the basics. In plain terms:

• Never post keys in screenshots, support forums or public code repositories.
• Share them only through a password manager or another secure channel.
• Regenerate them if you think they leaked, or if a developer who had them has left.
• If you grant third-party API permissions, grant only what is needed, and revoke access for tools you no longer use.

If you worry that something stranger is going on, such as unexpected PayPal activity or a changed checkout page, see our guide on what to do if your website was hacked. A credentials mismatch like this one is almost always a plain setup mistake, not an attack.

Key takeaways

• Error 10002 'Security header is not valid' means PayPal rejected your API username, password or signature.
• It is a credentials problem and has nothing to do with HTTP security headers.
• Match sandbox keys to sandbox mode and live keys to live mode. Never mix them.
• Paste each value through a plain text editor to remove stray spaces, then regenerate the credentials if checkout still fails.
• Treat PayPal keys like passwords: keep them out of screenshots, chats and public code.

Want a human to look at the rest of your site?

Fixing checkout is one job. Knowing whether the rest of your site is safe is another. A Bug Circuit Circuit audit costs $49 one-time. A real security engineer manually reviews your site and sends a written report with severity, evidence and exact fixes. It is a focused small-site audit, not a multi-week enterprise pentest or a compliance certification. If you want a no-cost starting point first, try the free website security check.