Braintree CVV Test API: Test CVV Verification in Sandbox

The Braintree CVV test API is the sandbox path you call with a test card number and a CVV value to see how Braintree reports CVV verification. It returns fields such as cvv_response_code (M for match, N for no match, U for not verified) and cvv_response_text next to the normal transaction response. Calls go to the sandbox gateway with sandbox API keys, so no live card data is involved.

Braintree CVV Test Guide: Sandbox Values and Response Codes

How does Braintree report a CVV check?

Braintree passes the issuer's answer back on the credit card object as a single letter code plus a short text description. The code says what the issuer decided about the CVV. The text repeats that decision in words.

braintree cvv testing

• M: CVV matches. The value sent lines up with the issuer's record.
• N: CVV does not match.
• U: CVV not verified. The issuer or processor returned no answer.
• S: The issuer does not support CVV verification for that card.
• I: CVV was not provided, or the check does not apply to that card type.

A result of M does not mean the payment is safe. It means one input matched one record. AVS, fraud tools, and 3D Secure live in separate parts of the response.

braintree cvv testing

How do you run a CVV test in the sandbox?

1. Open the sandbox Control Panel and copy your sandbox merchant ID, public key, and private key.
2. Send a POST to the sandbox transactions endpoint, or use a client SDK that hands your server a payment method nonce.
3. Include a test card number, for example 4012888888881881 (Visa) or 5555555555554444 (Mastercard), with a CVV string.
4. Set options.verify_card for a verification, or complete a normal sale.
5. Read cvv_response_code from the response and compare it with the result you meant to test.

Sandbox calls never settle and never cost money. The response shape matches production, which is the point of testing there.

Which CVV values produce each response code?

Braintree's sandbox accepts almost any CVV and returns M. The value used in most examples is 123.

To see N, U, S, or I you need the specific values from Braintree's current test values page. That mapping changes when the sandbox is refreshed, so pull the table before you hardcode assertions.

Amex cards use a four digit CID printed on the front of the card, not a three digit CVV. Test those with four digits.

How do you force a CVV decline in the sandbox?

Braintree's sandbox also maps certain transaction amounts to processor declines. Amounts in the 2000.00 to 2020.00 range trigger set responses, and 2010.00 returns a card issuer CVV decline. Check that number against the live table before you commit it to a test suite.

Amount rules fire on the whole transaction, so assert on both processor_response_code and cvv_response_code when a decline is your expected result.

Does Hosted Fields change how you test CVV?

No. With Hosted Fields or the Drop-in UI the CVV input sits in an iframe and your server receives a payment method nonce instead of the digits. The CVV result still arrives on the transaction or verification object. Point the client at sandbox keys and the flow behaves the same as production.

Which fields should your test suite assert on?

• cvv_response_code and cvv_response_text on the credit card object.
• processor_response_code and processor_response_text when an amount rule fires.
• gateway_rejection_reason when the call never reaches a processor.
• status, to tell settled, processor_declined, and gateway_rejected apart.

What breaks a CVV test?

• Production API keys paired with test card numbers.
• A card type that does not support CVV checks, which returns S or I.
• Reusing a payment method nonce that was already consumed.
• Reading processor_response_code when you want cvv_response_code, or the reverse.
• Assuming every issuer returns a verification answer. Many return U, in sandbox and in live traffic.

Can you store CVV data or test it with live cards?

No. PCI DSS forbids storing the CVV or CVC after authorization, and the Braintree vault keeps a card token rather than the verification value. Putting live card numbers into a sandbox also breaks card network rules and can cost you your merchant account.

Numbers sold as fresh CVVs come from stolen cards or from generators. Issuers check the value against their own record at authorization, so bought data fails on any real charge. Running those values through a test API tells you nothing about a live authorization.

FAQ

Do sandbox CVV checks cost money?

No. Sandbox transactions never settle and Braintree does not bill for them.

Why does my CVV test return U?

U means the issuer or processor gave no verification answer. Some card types and some sandbox test values always return U, so the result is expected rather than a bug in your integration.

What is the difference between cvv_response_code and processor_response_code?

cvv_response_code covers the CVV check alone. processor_response_code carries the processor's decision on the full authorization, for example 2000 for do not honor. A transaction can pass CVV and still be declined.

Can I test a 4-digit CVV?

Yes. Amex uses a four digit CID, and Braintree accepts four digits for those cards in sandbox.