There can be 2 issues : 
1. Wrong api key and secret key used.
2. Url used needs to be same for the keys using 
Example : 
live url : 'https://www.pesapal.com/api/'
demo url : 'https://demo.pesapal.com/api/'