Braintree CVV Test Documentation: Sandbox Codes Guide

Braintree's own testing documentation, published alongside the rest of the Braintree developer reference on PayPal's developer site, is the top pick for any question about CVV testing, because it is the only source tied to the gateway build your integration actually calls. The criteria that matter are coverage of the CVV response codes, a sandbox test card list that maps to each card brand, and a clear line between sandbox behavior and the behavior of a live merchant account with CVV rules switched on.

related article

Option 1: Braintree's official testing page

This is the primary source. It lists sandbox card numbers, explains which requests succeed, and links the transaction response fields you will parse in code. When the page and a blog post disagree, the page wins.

Braintree CVV Test Example

Pros

• Matches the gateway version in production, so a passing sandbox test usually means something.
• Separates card number testing from CVV and AVS response testing.
• Names the response fields, so you can map documentation to your JSON parser.

Cons

• Content moved between Braintree's domain and PayPal's developer portal, so older bookmarks and cached copies drift out of date.
• It assumes you already know the difference between authorization, settlement, and card verification.

Option 2: The AVS and CVV response code reference

A separate page carries the code table. Treat it as the dictionary you keep open while writing assertions, not as a tutorial.

braintree cvv verification

Pros

• Short, stable, and copy friendly for test fixtures.
• Covers both address and CVV checks in one place.

Cons

• Codes describe what the issuer returned, not what your account will do about it.
• A few gateway specific extras appear beyond the common six, which trips up strict switch statements.

Option 3: Community answers and support threads

Forum posts help when you are stuck on an edge case, such as a verification that returns a CVV code you did not expect.

Pros

• Fast when the official page is silent on a specific combination.
• Often includes raw response payloads, which is useful for building parsers.

Cons

• Answers reference documentation revisions that no longer exist.
• Some posts mix sandbox trigger values with production behavior and produce false conclusions.

Criterion: which card numbers belong in sandbox tests

Sandbox card numbers are public test values. Common ones include 4111111111111111 for Visa, 5555555555554444 for Mastercard, 378282246310005 for American Express, and 6011111111111117 for Discover. They return approvals in sandbox and fail in production. Pair each number with a CVV of your choosing and confirm the response through the current testing table rather than a list you saved last year.

Criterion: CVV response codes and what they mean

• M: the CVV matches what the issuer holds.
• N: the CVV does not match. This is the code behind most mismatch tests.
• U: the issuer cannot verify the CVV, often because the card or region does not support the check.
• S: the CVV should be present but was not supplied, which points at a keyed entry or a card without a CVV.
• P: the CVV was not processed.
• I: the issuer returned no CVV result.

A mismatch does not always decline a transaction. Whether N, S, U, P, or I stops the sale depends on the CVV rules configured on the merchant account, and those rules live outside the sandbox defaults. If a sandbox mismatch passes with an approval, that is not proof your live account will do the same.

Criterion: reading cvv_response_code in the response

The transaction and verification responses carry a CVV result field plus a processor response code and text. Log the field on every test run, assert on the letter, and avoid asserting on the human readable text, which changes without notice. If your fixtures hardcode trigger values copied from an older documentation revision, they may stop returning the code you expect, so re-check the testing page before you trust a red build.

Where CVV testing stops and PCI rules start

PCI DSS forbids storing sensitive authentication data, including the CVV, after authorization. That rule applies to test environments too. Never point sandbox keys at live cardholder data, and never keep a CVV in a log, a fixture file, or a database column. Test numbers exist so you never need real card data to verify a CVV path.

Use-case recommendation

If you are writing an integration test suite, start with the official testing page and the response code reference, use the published test card numbers, and assert only on the code letters. If you are a merchant tuning decline rules, test with the same rules enabled that you run in production, and read the response code reference to decide which letters should block a sale. If you are auditing an old codebase, search for hardcoded CVV trigger values first, because those are the checks most likely to be stale.