Short answer

Razorpay does not expose a standalone CVV test API. The CVV travels inside the standard payment payload, and in test mode the sandbox accepts any three digit value for the published success test cards. You copy a Razorpay test card number, add a future expiry, type any CVV such as 123, and the payment entity comes back with the status captured. Nothing reaches a real card network because test mode keys only talk to Razorpay's sandbox.

more on this topic

Prerequisites

• A Razorpay account with test mode keys. Test key ids start with rzp_test_.
• A server or browser page that can reach the Razorpay API over HTTPS.
• Access to the Razorpay dashboard in test mode so you can inspect the payment records.

Steps

1. Log in to the Razorpay dashboard and flip the mode switch to Test Mode.
2. Open Account and Settings, then API Keys, and copy the key id and key secret.
3. Create an order with a POST request that carries amount, currency, and receipt, authenticated with your test key pair.
4. Save the order id from the response.
5. Build the payment payload with card number, expiry month, expiry year, and a CVV of 123.
6. Pick a published success test card number, for example a 4111 Visa number, for the card field.
7. Submit the payment through the checkout or the server side call.
8. Finish the 3DS challenge with the documented test OTP when the card you picked requires authentication.
9. Fetch the payment id and confirm the status field reads captured.
10. Rerun the flow with a decline test card to verify your failure path fires.

How the CVV field behaves in test mode

Razorpay publishes a test card list, and most success entries carry the note that the CVV can be any value. The sandbox does not compare the digits against an issuer record, so 123, 456, and 000 all pass. Cards that Razorpay marks for declines are declined for the reason printed next to them, typically an issuer response code, and the CVV you typed is not the trigger. Razorpay also rotates and adds test cards over time, so pull the current list from the documentation instead of hardcoding a number you copied months ago.

Razorpay CVV Testing Service: How to Buy CVV Safely

Common test mode errors

• BAD_REQUEST_ERROR with a key id mismatch means you sent a test key against live data or the reverse.
• Authentication failures usually mean the key secret was truncated or swapped with the key id.
• A card declined response on a success test card normally points to a malformed expiry month or year field.

Rules that do not change

PCI DSS forbids storing the CVV or CVC after an authorization, and test data is no excuse to build a habit you cannot keep in production. Never point a test card at live keys, and never treat a sandbox pass as proof that a real card will authorize. Test mode proves your integration wiring, the request shape, the webhook handling, and the error branches. Issuer checks, 3DS risk scoring, and real CVV matching happen only in live mode with a real cardholder.

related article