In the Authorize.net sandbox, the test CVV can be any three-digit number for Visa, Mastercard and Discover, or any four-digit number for American Express. Most developers use 123 (or 1234 for Amex), because the sandbox accepts it and returns a successful card code match for a standard test card.
What to type in the CVV field for each test card
The card code is only checked against test values, not against a real issuer, so the number you enter does not need to look realistic. What matters is that it matches the length expected for the card type, otherwise your integration may reject the request before it reaches Authorize.net.
Buying Guide: How to Choose the Best CVV for Your Transactions with Authorize.Net
- Visa: 123
- Mastercard: 123
- Discover: 123
- American Express: 1234
- JCB and Diners Club: 123 (Diners test cards follow their own format rules in newer API versions)
Authorize.net test card numbers to pair with the CVV
Use the sandbox card numbers published by Authorize.net so the test CVV question does not turn into a card number problem. A standard set:
authorize.net test cvv vs adyen
- Visa: 4111 1111 1111 1111
- Mastercard: 5424 0000 0000 0015
- American Express: 3700 0000 0000 002
- Discover: 6011 0000 0000 0012
- JCB: 3530 1113 3330 0000
- Diners Club: 3800 0000 0000 06
Set the expiration date to any month in the future. Past-dated test cards are declined before the card code is evaluated, which is one reason a correct CVV can still look broken.
authorize.net test cvv alternative
Does the sandbox really validate the card code?
It simulates validation. Authorize.net does not contact an issuer in test mode, so the card code response comes from the test values and the Card Code Verification settings on the sandbox account. The developer documentation lists specific CVV2 values, including a range used to force a mismatch or an unprocessed response, so you can confirm that your checkout shows the right error when a card code fails.
If your goal is only to complete a test order, 123 is enough. If your goal is to test every branch of your payment flow, run the same transaction with the mismatch values from the test-value table and confirm your code reads the response reason code for a card code failure instead of treating it as a generic decline.
Why your test CVV still gets rejected
A rejected card code in the sandbox is usually a configuration issue, not a wrong number. Check these in order:
- Wrong endpoint. Sandbox calls go to the test gateway host; production credentials fail against the test host and the reverse is also true.
- Test mode vs sandbox account. A production account with test mode switched on behaves differently from a separate sandbox account.
- Card code filter enabled. If the account is set to reject transactions when the CVV does not match, a deliberately mismatched test value will decline the order.
- Field formatting. Send the card code as a string in the correct field, keep leading zeros, and do not send it for stored-credential transactions where the industry rules do not allow it.
- Expired test card. A past expiration date overrides everything else in the request.
Quick test sequence
- Log in to a sandbox account and copy the API login ID and transaction key.
- Point your integration at the test gateway host.
- Submit a test card number with CVV 123, or 1234 for Amex.
- Use a future expiration date and confirm the response shows an approved transaction.
- Repeat with a mismatch CVV from the documentation and confirm your error handling fires.
Two rules worth repeating
Never test with a real card number, and never store the CVV after authorization. Card code values fall under PCI DSS requirements, and keeping them in a database or log puts the integration out of compliance even when the transactions are small.