While attempting, and failing, to set the timeout for HTTP calls to the CyberSource gateway via the Configuration.Timeout I tracked it down to a second instance of the RestClient being created.

I'm not really sure what the code is meant to be doing at that point. It seems like ApiClient creates a RestClient instance in its contructor with the intention of using it for the API call. Configuration values are applied to that instance. But then a brand new instance is created in CallAuthenticationHeaders and it does not have the Configuration values applied.

I can fix my problem by changing:

RestClient = new RestClient("https://" + merchantConfig.HostName);

to

RestClient.BaseUrl = new Uri("https://" + merchantConfig.HostName);

It does seem to be a somewhat confusing and error prone approach. It would seem better to stick to setting the hostname in the ApiClient constructor rather than burying it down in an entry in the Configuration.MerchantConfigDictionaryObj dictionary.