We had Paypal working fine on the development site (M 2.4.2) using Sandbox. However when the site went live and we tried switching to the live system it wouldn't work. The paypal button appears but on clicking the user gets bumped back to the cart page and there is an error "PayPal gateway has rejected request. Security header is not valid (#10002: Security error)."

We are not using Express or Braintree, just simple Website Payments Standard.

According to this site - https://theecommmanager.com/solve-paypal-gateway-rejected-request-security-header-not-valid-10002-security-error/ - the error implies either incorrect credentials or endpoint.

Tried inputting the details into this and it came back with Success so I think the credentials are correct.


So is there any way of checking the endpoint. Is there a hidden setting somewhere we've missed? Is there any chance there could be leftover code somewhere referring to Sandbox or the test environment? I haven't found any but thought I'd ask.

ETA a colleague has spent a lot of time on the phone to Paypal customer support and no luck on that end.

ETA - found how to debug and viewing the log it has

[2022-01-21 15:13:05] main.DEBUG: array ( 'url' => 'https://api-3t.sandbox.paypal.com/nvp', 'SetExpressCheckout' =>

So, where is this sandbox URL coming from? Where do we set it from sandbox to live?

1 Answer 1


So it turns out it was a setting within a different Magento scope. While the Default Config had Sandbox set to No, the Main store one had it set to yes so this was overwriting it. Hopefully this helps someone else in the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.