A Razorpay CVV validation test checks two things: that your checkout collects the card security code in the format Razorpay expects, and that your code handles the response when that code does not match. In test mode most Razorpay test cards pass with any 3-digit CVV, so a useful CVV test forces a failure and inspects the error object instead of typing random digits.

Razorpay CVV Test API: A Comprehensive Guide

What does Razorpay do with a CVV?

Razorpay checks the CVV at two points in the payment flow. The checkout form validates the format in the browser before card data leaves the page. The card network then matches the value against the issuer record, but only in live mode.

razorpay cvv validation test

• Format check: 3 digits for Visa, Mastercard and RuPay, 4 digits for American Express.
• Numeric check: letters, spaces and symbols fail before the request is sent.
• Storage: Razorpay does not keep the CVV after authorization, and PCI DSS rules forbid it.
• Live check: the issuer approves or declines the match, and Razorpay passes that result back to your integration.

Test mode skips the issuer match for most cards. The sandbox returns success even when the digits would fail a live check, which is why testers see the same result for CVV 123 and CVV 999.

related article

How do you run a CVV validation test in Razorpay test mode?

Use test keys and the documented test cards. Live keys, live cards and production webhooks will not give you a clean CVV test.

razorpay credit card cvv validation test

1. Switch your Razorpay dashboard to Test Mode and copy the test key ID and key secret.
2. Load your checkout with those keys. Live keys are rejected in test mode.
3. Open the Razorpay test card list and pick a card that maps to the outcome you need.
4. Enter a 3-digit CVV, then change one digit at a time and watch for a change in the response.
5. Read the response in the checkout handler and in the payment.failed webhook.
6. Log the error fields: code, description, source, step and reason.

Razorpay updates its test card list from time to time. Pull current numbers from the Razorpay docs page for test cards rather than from an old tutorial, since retired numbers fail for reasons that have nothing to do with CVV handling.

Which Razorpay test cards trigger a CVV failure?

Razorpay publishes test cards that map to specific outcomes: success, failure, and in some sets, a 3DS challenge or a timeout. The sandbox decides which field causes a decline, so a card on the failure list may fail on the CVV check or on another field such as the expiry date.

Read the failure response before you blame the CVV. If the error step points at authentication or at the bank, your CVV handling is not the cause. When you do find a card and CVV pair that produces a decline, write both down in your test notes and reuse that pair in your automated suite.

How do you test the CVV field on your own checkout?

A large share of CVV bugs live in your own form, not in Razorpay. Check your layer first.

• The field is required and a whitespace-only value does not pass.
• Input takes digits and stops at 3 characters, or 4 for American Express.
• Pasted text is stripped of spaces, letters and dashes.
• autocomplete="cc-csc" is set so browsers and password managers fill the right box.
• The CVV never reaches your server and never lands in a log file.
• Error text tells the customer which field to fix, not just that something failed.

If you host your own card form, the CVV should go straight to the payment provider through their tokenization or hosted fields. Anything else puts you in scope for card data storage rules.

What does a CVV failure look like in the API response?

Razorpay returns a structured error object when a payment fails. The fields carry more weight than the message.

• code: a short string such as BAD_REQUEST_ERROR or GATEWAY_ERROR.
• description: the readable reason, often phrased as a card or bank decline note.
• source: the layer that raised the error, such as the card, the bank or the gateway.
• step: the stage that failed, such as authentication.
• reason: the field-level cause, which in some cases is the security code check.

Never branch your code on the description text. Banks and Razorpay edit those strings, and a wording change will break your logic without warning. Branch on code and step, and show the description to the customer.

The payment.failed webhook carries the same data. Store it against the order so you can reconcile a failed attempt later without asking the customer what they saw on screen.

Common mistakes in CVV testing

• Testing with live keys and then wondering why every card succeeds.
• Assuming that an accepted test CVV proves your live CVV handling works. It does not, because the issuer does that check.
• Retrying a failed payment by storing the CVV for later. PCI DSS does not allow it.
• Hard-coding test card numbers into a production config file.
• Ignoring the error returned to the checkout handler and reading only the order status.
• Using a random 16-digit number for a card test instead of a documented test card.

FAQ

Does Razorpay validate CVV in test mode?

It validates the format and length of the code. Most test cards then return success regardless of the digits you type, because no issuer is involved.

Is any CVV accepted on Razorpay test cards?

On the standard success cards, yes. Failure cards are built to decline, and the decline may or may not be tied to the CVV field. The error step field tells you which field to look at.

Can I store a CVV to retry a payment?

No. PCI DSS bans storing the card verification value after authorization, and Razorpay does not return it to you. Ask the customer to enter the code again.

Why does my live CVV test fail when test mode passes?

In live mode the issuer checks the value against its own record. A mismatch returns a decline that the sandbox never produces, because the sandbox has no issuer record to compare against.