What a sandbox test CVV is

A sandbox test CVV is a fake card verification value that a payment processor accepts only in its test environment. It is paired with a test card number, such as 4242 4242 4242 4242, and it never reaches a real bank account. Most processors ignore the CVV field in test mode, so any three digits work. Others require a specific value to trigger a pass or a decline so you can test both paths.

Prerequisites

• A sandbox or test account with your processor
• Test API keys, not live keys
• The processor's published test card numbers

How to use a sandbox test CVV

1. Open your processor's test card reference page and copy one test card number.
2. Switch your integration to test mode by loading the test API key or test publishable key.
3. Enter the test card number in the card field of your checkout form.
4. Enter a test CVV. Use 123 for most processors unless the reference page states a different value.
5. Set the expiry date to any future date, such as 12/34.
6. Submit the payment and read the response object your server receives.
7. Repeat the charge with a decline CVV to confirm your error handling works.

Common test CVV values

• Stripe: any three digits succeed in test mode, and 123 is the usual choice.
• Braintree: 123 passes CVV verification, 200 fails it.
• Adyen: published test cards accept any three digit CVC.
• PayPal: sandbox test cards accept any CVV value.

Always confirm against the reference page for your account region, because processors add and retire test values over time.

Why a test CVV fails in live mode

A test CVV belongs to a test card number that no issuer recognizes. If you send it to a live endpoint, the issuer returns an invalid card number or no such issuer response before the CVV is checked. A decline there is expected behavior, not a defect in your integration. Seeing live declines from test data is normal and confirms you are pointed at the wrong key.

Troubleshooting

• If every test charge declines, confirm you are not using live keys.
• If CVV checks always pass, your test mode likely ignores the field by design.
• If a valid test card is rejected, check the expiry date and the card brand settings on your account.
• If declines appear with no response body, inspect your webhook or server logs for the raw error.

Handling real card data

Test values exist so you never need real card numbers during development. Do not store the CVV after authorization and do not write it to logs. PCI DSS prohibits retaining the card verification value once a transaction completes, and that rule applies to production systems you build with the same code you tested.