Quick answer

In the Adyen test environment, the CVV field is not checked against a real cardholder. Use the CVC printed next to the card number in Adyen's test card list. The standard Visa and Mastercard test cards typically use 737, and the American Express test card uses a four-digit value. Any three-digit number usually passes a basic authorization unless that specific test card is configured to return a CVC refusal, so the safest approach is to copy the CVC that Adyen pairs with the card.

Prerequisites

  • An Adyen account with access to the test environment
  • A test API key created in the Customer Area
  • Access to Adyen's published test card numbers page
  • A sandbox integration that sends card data to the Checkout API

How to use a test CVV in the sandbox

  1. Sign in to the Adyen Customer Area and switch the company selector to the test environment.
  2. Create a test API key and store it in your sandbox configuration only.
  3. Open the test card numbers page and pick a card for the scheme you want to test.
  4. Copy the card number, expiry month, expiry year, and the CVC shown in the same row.
  5. Send a /payments request with a scheme payment method and put the copied value in the cvc field.
  6. Read the resultCode in the response and confirm the payment reached the state you expected.
  7. Repeat the call with a different test card when you need a specific refusal reason.

Why the CVV rarely fails in test

The sandbox validates format, not authenticity. Adyen returns Authorised for most well-formed requests because there is no issuer to verify the security code. Cards in the refusal list are the exception: Adyen configures those numbers to return a fixed refusal, and some are set up to trigger a CVC-specific decline so you can exercise that branch of your error handling.

Common mistakes

  • Using a live API key against the test endpoint, or a test key against the live endpoint
  • Pasting a real card number, even your own, into a sandbox request
  • Assuming a wrong CVV always declines; in test it usually does not
  • Expecting 3-D Secure to behave like production without configuring a test authentication flow
  • Hardcoding one CVC instead of reading the value from Adyen's table, which changes over time

Before you ship, run the same scenarios against live endpoints with real cards issued to your business, and confirm your integration handles CVC declines, expired cards, and issuer refusals separately.