The config settings can be in Web.config or user.config, but it is better to put them in user.config since that makes it easier when you upgrade, you won't lose those settings when you get a new Web.config file in an upgrade. However keep in mind that changes you make in user.config are not automatically detected like they are in Web.config, so when you make a change in user.config you need to touch Web.config (ie type a space in it and save it) to make it reload all settings.
To use Authorize.NET you need an account for Authorize.NET, the demo sites use a test account against the Authorize.NET test servers, configured like this:
<add key="Site1-PrimaryPaymentGateway" value="Authorize.NET" />
<add key="Site1-PaymentGatewayUseTestMode" value="true" /> (would be false for production)
these are for the test server
<add key="Site1-AuthorizeNetSandboxAPILogin" value="xxxxxxxx" />
<add key="Site1-AuthorizeNetSandboxAPITransactionKey" value="yyyyyyyy" />
for production:
<add key="Site1-AuthorizeNetProductionAPILogin" value="xxxxxxxx" />
<add key="Site1-AuthorizeNetProductionAPITransactionKey" value="yyyyyyyy" />
of course the xxxxxx and yyyyy are just place holders where your account credentials go
Hope it helps,
Joe