You need to set testMode
to false
, or just leave it out entirely (false is the default).
Security header invalid
This means that you are trying to use test credentials with the production environment (which it sounds like you were).
You don't want to create REST credentials, you need to create API credentials for the standard PayPal NVP API.
PayPal Express requires an API Username, Password, and Signature. These are different from your PayPal account details. You can obtain your API details by logging in to your (live) PayPal account, and clicking Profile > My Selling Tools > API Access > Request/View API Credentials > Request API Signature.