CVV Test API: Sandbox Values, Rules, and Limits

Answer

A CVV test API is a sandbox endpoint that checks the card verification value on a test card. It returns a pass or fail code. It never contacts a card issuer. It never moves money. Payment processors publish the accepted test values in their developer docs. Stripe lists test card 4242 4242 4242 4242 with CVV 123. Adyen lists the same card number with CVC 737. Braintree lists 4012 8888 8888 1881 with CVV 123. A value that passes on one gateway can fail on another.

cvv validation api

Test values by card brand

• Visa, Mastercard, Discover: 3 digits. Common published values are 123, 000, and 999.
• American Express: 4 digits, printed on the front above the card number. Common test value is 1234.
• UnionPay: 3 digits.

Test expiry dates are fake, set to a future month and year. Test card numbers pass the Luhn check. That check catches single-digit typos and transposed digits.

cvv test endpoint

How the API call runs

1. The client sends card number, expiry, and CVV to the gateway in test mode.
2. The gateway runs a Luhn check and a format check on the CVV field.
3. The gateway maps the test card number to a stored response.
4. The gateway returns an approval, a decline, or an error code such as incorrect_cvc.

Steps 2 and 3 run inside the gateway. No issuer host is involved. Latency is low, under 300 ms.

cvv test endpoint

Rules the CVV field uses

• Length is fixed per brand. Three digits for most brands, four for Amex.
• Numeric digits. No spaces, letters, or punctuation.
• The field cannot be blank on a card-not-present charge when the issuer supports CVV checks.
• After authorization the value is not stored. PCI DSS Requirement 3.2 bans storage of sensitive authentication data post-authorization.

Test mode compared to live mode

Test mode uses separate API keys. Requests go to a sandbox host. Responses come from a fixed table, so the same input gives the same result each time. Live mode sends the request to the issuer. The issuer returns a CVV result code in the authorization response. Processors do not expose stored CVV data through any API. No endpoint returns the CVV of a real card.

Legal boundary

In the US, 18 U.S.C. § 1029 covers trafficking in card credentials. Selling or buying CVV data tied to real cards is a federal offense. Payment APIs are built for merchants and developers who test their own integrations. Any service that advertises bulk CVV data operates outside the card networks and outside the law.