CVV Test API: Validate CVC Checks in a Sandbox

A CVV test API is a sandbox endpoint on a payment gateway that accepts synthetic test card numbers and returns the same CVC validation responses a live transaction would produce. You use it to confirm your checkout transmits the security code, that your code reads the response, and that a failed CVC check declines without charging anyone.

CVV Test API Documentation

What the endpoint returns

Response structure mirrors production, but the card data is fake. Expect these fields:

cvv validation api

• Result code: approved, soft decline, or hard decline
• Decline reason tied to the CVC, for example incorrect CVC or CVC not verified
• An authorization ID you can reuse for capture and refund tests
• The raw gateway response for your logging checks

Prerequisites

• Sandbox API keys from your gateway, kept separate from live keys
• The gateway's published test card numbers for every brand you accept
• A request logger that stores full response bodies

How to test CVV handling

1. Point the API base URL at the sandbox host.
2. Load the published test card numbers into your test fixtures.
3. Send an authorization request with a valid CVC for each card brand.
4. Assert that the response returns approved and that no CVC value was stored.
5. Resend the same request using the incorrect-CVC test value from the docs.
6. Assert the expected decline code appears and that no charge posts.
7. Send a request with the CVC field left empty.
8. Confirm your form blocks submission or the gateway returns a missing-data error.
9. Log request IDs and response codes, then compare them against the gateway's decline code table.

Values worth covering

• Valid CVC per brand: three digits, four for American Express
• The incorrect-CVC trigger value listed in the gateway docs
• Missing field
• Non-numeric input, to exercise client-side validation
• Expired card paired with a valid CVC

Common failure modes

• Sending a real card number to a sandbox: the request fails and can flag your account
• Hard-coding one brand's CVC length, which breaks Amex
• Reading only the HTTP status instead of the decline code in the body
• Persisting the CVC in your database or logs

What you must not do

The card verification value exists to prove the person at checkout holds the physical card. Purchased, shared, or scraped card data has no place in a test environment: sandbox testing only works with numbers the processor publishes. PCI DSS also forbids storing the code after authorization, so strip it from logs before they leave the request handler.

cvv test api free