A sandbox test CVV code is a placeholder security code, normally 3 digits and 4 digits for American Express, that a payment gateway accepts while your account runs in test mode. Sandbox transactions never reach a real card issuer, so any value that matches the simulator's rule set will approve. Developers use these codes to build checkout flows, test CVC decline handling, and confirm response logic before switching to live keys.
Sandbox Test CVV Sample: A Guide for Payment Testing
Do sandbox test CVV codes have to be real?
No. A sandbox CVV is fake data with no link to a cardholder account. Stripe, for example, accepts any CVC with its standard test card numbers, so 4242 4242 4242 4242 works with 123, 999, or any 3 digit string and any future expiry date.
Some gateways reserve specific CVV values to trigger a specific outcome, such as a CVC mismatch decline. In that setup the number is a signal to the simulator, not a credential.
Common sandbox test CVV values by gateway
- Stripe: any 3 digit CVC for most test cards. Certain hard coded cards force an outcome regardless of the CVV you enter, such as a card that always returns an incorrect CVC decline.
- Braintree: the classic test card 4012 8888 8888 1881 pairs with CVV 123 for an approval, and CVV rules can be toggled in the control panel.
- Authorize.Net: test card 4007 0000 0002 7 with CVV 123 returns an approval in the sandbox, while mismatch tests use dedicated response codes.
- Adyen: test cards expect a fixed CVC from the documentation. An unmatched value returns a Refused result with a CVC related reason code.
- PayPal Payflow: processor test cards pair with a fixed CVC such as 123 for approvals.
Why test CVV decline scenarios?
Issuers decline a charge when the CVC does not match, and your integration must handle that response without crashing or double charging. Sandbox tools let you simulate a CVC failure with a specific test card or a specific CVV value. Skipping this step is a common source of production support tickets.
Sandbox CVV vs a live CVV
A live CVV is a genuine verification value printed on a real card, and PCI DSS rules forbid storing it after authorization. A sandbox CVV is fake data that never leaves the test environment and carries no compliance weight. Never paste a real CVV into a test environment, a ticket, or a log file.
Frequently asked questions
Does any 3 digit number work as a sandbox CVV?
For most gateways yes, but some simulators map particular CVV values to particular outcomes. Check your provider's test data page before assuming any value passes.
Why does my sandbox test card return an invalid CVC error?
The card number you picked may be a hard coded decline card. Switch to a standard approval card, or supply the exact CVV listed in the gateway's test data table.
Are 4 digit CVVs used in sandbox tests?
Yes. American Express uses a 4 digit card identification number, so sandbox tests for Amex expect 4 digits instead of 3.
Testing checklist
- Use the gateway's own published test card numbers.
- Match CVV length to the card brand.
- Run at least one approval and one CVC failure.
- Verify the response code and reason text your code receives.
- Confirm no test CVV value reaches a production database or log.