There can be 2 issues : 1. Wrong api key and secret key used. 2. Url used needs to be same for the keys using Example : live url : 'https://www.pesapal.com/api/' demo url : 'https://demo.pesapal.com/api/'