What a test CVV payment page is

A test CVV payment page is a checkout form running in a payment processor sandbox. It accepts published test card numbers and any correctly formatted security code, so developers can confirm the form validates the CVV field, sends the right authorization request, and renders the right response. No real cardholder data is involved and no money moves.

How to Test CVV Checkout: A Comprehensive Guide

Prerequisites

• A sandbox account with a processor such as Stripe, Braintree, or Adyen.
• Test mode API keys loaded in your staging environment.
• A reachable staging URL for the checkout page.
• The processor's current list of published test card numbers.

Steps to test a CVV payment page

1. Switch the integration to test mode and confirm the page calls the sandbox endpoint, not the live one.
2. Open the checkout page in a private browser window so no saved card autofills the fields.
3. Enter a published test card number for the brand you want to check, such as 4242 4242 4242 4242 for Visa.
4. Type any three digit code for Visa, Mastercard, or Discover, or any four digit code for American Express.
5. Use a future expiry date and whatever postal code the processor documents for that test number.
6. Submit the form, then read the response body and HTTP status code, not just the on screen message.
7. Repeat the run with a decline test card to confirm your error handling covers a rejected authorization.
8. Open the sandbox dashboard and check which fields the gateway logged for that transaction.
9. Repeat for every card brand you support, since Amex uses four digits and most other brands use three.

Common sandbox values

• Visa approval: 4242 4242 4242 4242, CVV 123
• Mastercard approval: 5555 5555 5555 4444, CVV 123
• American Express approval: 3782 822463 10005, CVV 1234
• Generic decline: 4000 0000 0000 0002, CVV 123

Processors retire and replace these numbers, so pull the current list from your own sandbox documentation before each test cycle.

cvv checkout test

What a test CVV does not prove

A passing sandbox run says nothing about live issuer behavior, network timeouts, or the 3-D Secure challenges that only appear in production traffic. It also does not confirm that your storage meets PCI DSS. The card verification code must never be written to a database after authorization, and a sandbox run is a good moment to verify that your logs, traces, and analytics events do not capture that code either.

Checkout Card Verification Guide: How to Buy CVV