Braintree CVV Test Tool: Sandbox Values

Answer first

A Braintree CVV test tool is the sandbox path for checking how your integration reads a CVV verification result. You send a sandbox transaction with a published test card number and a CVV value. The gateway returns a CVV response code. No issuer is contacted. No money moves.

read more

Braintree is a payment gateway owned by PayPal.

braintree cvv validation

Sandbox and production are separate systems

Sandbox credentials work on the sandbox API host. Production credentials work on the production host. A test card number sent to production returns a decline. A live card number sent to the sandbox returns an error. Test values exist to exercise code paths, nothing else.

read more

CVV response codes the API returns

The result object carries a field named cvvResponseCode. The documented values:

• M: CVV matches.
• N: CVV does not match.
• U: issuer does not verify CVV.
• S: issuer does not participate in CVV verification.
• I: CVV was not provided.

AVS returns a separate field, postalResponseCode, with its own letter set.

Test card numbers used in the sandbox

Braintree's testing reference lists public numbers for each card brand:

• Visa: 4012888888881881
• Mastercard: 5555555555554444
• American Express: 378282246310005
• Discover: 6011111111111117

These numbers pass the Luhn check. They are published for testing and are not live accounts.

What is not fixed

Braintree does not promise a permanent map from a CVV string to a response code across sandbox versions. Sandbox behavior also depends on control panel settings for the merchant account. Read the current testing reference before you hard-code assertions. Put the values in one file so a change breaks one test, not forty.

Common mistakes

1. Using a production key with a test card. The gateway rejects the request.
2. Expecting a CVV mismatch to void the sale. By default it does not block the transaction. CVV rules are a control panel setting.
3. Storing the CVV after authorization. PCI DSS Requirement 3.2 forbids it.
4. Testing a stored-credential flow with a sale that never got vaulted. The vault must hold the payment method first.

Limits

Test values work in the sandbox and nowhere else. Reusing a real card number without the cardholder's authorization is a federal crime in the United States under 18 U.S.C. 1029. Braintree publishes no tool that turns a test value into a working charge.