Braintree CVV Test Guide: Sandbox Values and Codes

Braintree's sandbox treats CVV 123 as a passing verification and returns a processor decline for 200 and 201, which lets you exercise both the approved and rejected paths without live card data. Use a public test card number such as 4111111111111111, submit the sale through the sandbox API, then read cvv_response_code on the returned object. Every value stays inside a test environment and never reaches an issuer.

Braintree CVV Test API Guide: How to Use It for Security

What CVV values does the Braintree sandbox accept?

Braintree publishes a short list of CVV values that map to fixed verification outcomes in the sandbox. The list below covers the outcomes most merchants need.

more on this topic

• 123: verification passes and the transaction can settle.
• 200: CVV does not match, so the processor declines the authorization.
• 201: CVV is not verified, which also returns a processor decline.
• Blank: no CVV was supplied, which tests the not provided path.

Test data changes when Braintree updates its reference, so confirm the current list before you hard-code assertions around it.

Braintree CVV Test Tool: Sandbox Card Verification Guide

Why test with sandbox CVV values instead of a real card?

Card verification values must never be retained after authorization, and PCI scope expands fast when live numbers sit in a test database. Sandbox values return the same response codes with zero exposure. They also let you force a decline on demand, which is nearly impossible with a live card.

How do you run a CVV test in the Braintree sandbox?

1. Create a sandbox account and copy the merchant ID, public key, and private key from the control panel.
2. Generate a payment method nonce with Drop-in UI or Hosted Fields so the CVV is captured client side.
3. Submit a transaction sale or a card verification call using a test card number, the CVV value, and an amount.
4. Read cvv_response_code, processor_response_text, and status on the result object.
5. Repeat for each CVV value and assert on the expected outcome.

Verification calls authorize a small amount without capturing it, so CVV rules can be tested without real charges.

What do the CVV response codes mean?

The cvv_response_code field returns a single letter describing what the issuer said about the value.

• M: the CVV matches.
• N: the CVV does not match.
• U: the issuer does not support CVV verification.
• S: the issuer did not process the CVV check.
• Blank: no CVV was sent, or no check was requested.

A failed CVV check usually pairs with a numeric reason in processor_response_code, which is the field to log for support tickets.

How do CVV and AVS tests work together?

Enable both AVS and CVV rules on the merchant account before you test a combined check. Pair a test street address and postal code with the CVV value so the AVS result stays deterministic. Mixed outcomes, such as a CVV match with an AVS failure, are the most useful cases for tuning your decline message.

Do vaulted cards need a new CVV each time?

Yes. Card network rules and PCI DSS forbid storing the CVV, so the Braintree Vault keeps the card number and expiry only. A CVV rule can run only when the customer re-enters the value, which is why repeat charges on a stored card show no CVV result.

What are the common mistakes in Braintree CVV testing?

• Using live card numbers in the sandbox, which widens PCI scope and can trip issuer fraud controls.
• Assuming CVV 200 succeeds because the card number itself is valid.
• Testing CVV without CVV rules enabled on the account, which leaves the response empty.
• Pointing the SDK at production keys while feeding it sandbox values.

What is the CVV success value in the Braintree sandbox?

123 is the success value. Any valid test card number combined with 123 returns a match and lets the transaction proceed.

Which CVV value triggers a decline?

200 produces a CVV mismatch and a processor decline. 201 produces a not verified result and declines as well.

Can a CVV be stored in the Braintree Vault?

No. Network rules and PCI DSS prohibit retaining the value after authorization, so it must be collected again whenever a CVV rule is required.

Does the sandbox CVV list apply to production?

No. Those values are test artifacts. Production responses come from the issuer and reflect the real card and real cardholder.