What a Razorpay credit card CVV validation test proves

A Razorpay credit card CVV validation test confirms that your checkout collects the security code, sends it to Razorpay, and reacts to the gateway response. You run it in test mode with Razorpay's test cards, so no real card and no real money are involved.

razorpay cvv validation test

The test answers three questions. Does your form accept valid CVV formats and refuse invalid ones? Does it send the value to Razorpay in the right field? Does it show a clear message when the code is rejected?

razorpay cvv check

Razorpay test keys work on every account, and the sandbox returns the same error object shape you see in live mode. That makes it a safe place to build your handling logic before you flip to live payments.

read more

How CVV validation works in Razorpay

Razorpay Checkout renders the card fields, including the CVV, inside a hosted form. If you build a custom UI with the Orders API and your own inputs, you send the CVV in the request payload instead.

razorpay cvv test api

From there the value travels to the card network for the issuer's check. Sandbox mode skips that bank step, which is why test cards succeed with almost any well-formed CVV.

• Length: 3 digits for Visa, Mastercard, RuPay, and Discover. 4 digits for American Express.
• Characters: digits only. Letters, spaces, and symbols must be refused before submit.
• Luhn rule: the Luhn check applies to the card number, not to the CVV.
• Storage: PCI DSS bans keeping the CVV after authorization, in test mode and live mode alike.

How do you run a CVV validation test in Razorpay?

1. Log in to the Razorpay dashboard and switch to Test mode.
2. Copy the test key ID and key secret into your staging config, then restart the app.
3. Open your checkout page and pay with a Razorpay test card, using any future expiry date.
4. Run each case in the checklist below and note the response your code shows the user.
5. Open the Payments section of the dashboard and match each attempt to its status and error object.

Run the suite twice: once on the hosted Checkout, once on your custom form if you have one. The two paths validate the CVV in different places, and a rule that holds in one can break in the other.

CVV test cases worth running

• Empty CVV field, then submit. Expect a block on the client or a gateway error, never a crash.
• Two digits only. Expect the form to hold the submit until the length matches the card brand.
• Letters typed or pasted into the field. Expect them to be stripped or refused.
• Four digits on a Visa number. Expect a format error, since Amex is the 4-digit case.
• A wrong CVV on a test card that Razorpay marks as a failure card. Expect a decline with a readable reason.
• Paste and autofill on desktop and mobile. Expect the same result as typing by hand.
• A repeat charge on a saved token. Expect Razorpay to ask for the CVV again, because it was never stored.

What error appears when the CVV fails?

Razorpay wraps most of these in a BAD_REQUEST_ERROR, or a card error, with a code and a description field. Your job is to read the description and turn it into a sentence a shopper understands.

Do not print the raw JSON to the customer. Map it to lines such as "Check the 3-digit code on the back of your card" or "That code did not match."

What should your logs capture?

Log the environment, the order ID, the card brand, and the error code for each attempt. Keep the CVV out of every log line, including debug prints and crash reports. A test-run dashboard with these four fields makes a failed case easy to trace.

Which test cards should you use?

Razorpay publishes a test card list that covers success, failure, and 3D Secure step-up cases for Visa, Mastercard, RuPay, and Amex. The shared Visa test number 4111 1111 1111 1111 works for a success case in most accounts.

Use a future expiry date and a 3-digit CVV. Check the dashboard or the Razorpay docs before you run a suite, since the list changes and older numbers get retired.

Never test with a real card number, and never buy or borrow a CVV list for sandbox work. Real codes belong to the cardholder and may not be used or stored outside a live authorization.

Common reasons a CVV test fails

• Live keys left in the staging environment, so the network refuses the test card.
• The amount in the order does not match the amount sent at capture.
• Browser autofill dropping a saved card into a test session.
• The 3D Secure step is not handled, so the charge stalls at authentication.
• The test card was retired, or the account is blocked from test payments.
• A mobile SDK pointing at the live endpoint.

FAQ

Does Razorpay test mode check the CVV value?

No. Test mode skips the issuer check, so any well-formed CVV passes on a success card. Use the failure test cards when you need to see a declined payment.

What CVV length do I test for each card brand?

Visa, Mastercard, RuPay, and Discover use 3 digits. American Express uses 4. Build the input rule from the detected brand, not from one fixed length.

Can I store a CVV to charge a customer again?

No. PCI DSS forbids storing the CVV after authorization. Use Razorpay tokens for repeats and ask the customer for the code when the flow requires it.

Do I need a live Razorpay account to test CVV validation?

No. Test keys come with every account, so you can run the full set of CVV cases in test mode before you enable live payments.