Braintree CVV Test Documentation: 123, 200, 201

Braintree's sandbox maps three CVV values to three gateway results. Send 123 and the CVV check passes. Send 200 and the check fails. Send 201 and the gateway reports CVV not verified. The value goes in the cvv field of the credit card object, and the result comes back on the transaction as creditCard.cvvResponseCode.

Braintree CVV Test Guide: Sandbox Values and Response Codes

Sandbox CVV values

• 123: CVV matches. The transaction passes CVV rules.
• 200: CVV does not match. The gateway returns a CVV rejection when CVV rules are on.
• 201: CVV not verified. The processor returned no result.

These three values are the documented set. Braintree does not publish a separate CVV list per card brand. The sandbox values are three digits. American Express cards carry a four digit code in live traffic.

Braintree CVV Test Example

Where the value goes

Server SDK calls take the value inside the credit card object: number, expirationDate, cvv. The field name is cvv. Not cvv2, not cvv_code. On the client side, Hosted Fields and the Drop-in UI collect the code in a CVV field and return a payment method nonce. In that flow the raw value never reaches your server.

more on this topic

Reading the result

After a sale, the transaction object carries creditCard.cvvResponseCode. Four letters cover most cases:

• M: CVV matches
• N: CVV does not match
• U: CVV not verified
• I: CVV not provided

Some issuers also return S, for issuer does not participate, and E, for error. A rejection driven by your CVV rules sets gatewayRejectionReason to cvv. That rejection fires before the request reaches the processor.

Turning CVV rules on in the sandbox

CVV rules are a merchant account setting. A new sandbox account can have them off. With rules off, CVV 200 does not block a sale, and cvvResponseCode still reports N. Enable the rules in the Control Panel under Settings, then Processing. The same toggle exists in production, and production rules decide which response codes you decline.

Card numbers used with the codes

Use Braintree's published test numbers. Visa 4111111111111111, Mastercard 5555555555554444, American Express 378282246310005, Discover 6011111111111117. Any future expiration date works. The CVV value you send decides the CVV result. Braintree also publishes card numbers that trigger set responses, including CVV failures, for tests where you need a decline without touching the cvv field.

Common mistakes

• Sending a live card number with sandbox credentials. Keep test numbers in the sandbox.
• Reading cvvResponseCode without checking status. A declined transaction can still carry a CVV code.
• Treating 201 as a failure. It means no result arrived, and the CVV rules decide the outcome.
• Storing the CVV. PCI DSS forbids keeping the card verification value after authorization, in sandbox or in production.
• Assuming the gateway compares the code to an issuer record. In the sandbox it does not.

What the sandbox does not cover

The sandbox does not contact issuers. It does not reproduce issuer specific CVV behavior, partial matches, or regional rules outside the US. Test the production account with cards you control at low amounts before launch. CVV rule settings there can differ from the sandbox defaults.