CVV Test Automation Tutorial: Sandbox Checkout Testing

What CVV test automation covers

CVV test automation means driving the card security code field on a checkout form with sandbox values, then asserting that validation, tokenization, and error handling behave as designed. Every value comes from the payment processor's published test card list. Real card numbers never enter the test suite, the fixture files, or the CI logs.

more on this topic

The payoff is regression coverage. A checkout refactor that breaks the three-digit length check or drops the Amex four-digit rule gets caught before release instead of after a support ticket.

cvv test automation tool

Prerequisites

• A sandbox merchant account (Stripe test mode, Braintree sandbox, or Adyen test).
• Node.js 18 or newer installed locally.
• A checkout page that accepts card payments in a test environment.
• Access to your CI provider's secret store.

Step-by-step procedure

1. Create sandbox API credentials. Copy the test publishable key and secret key from your processor dashboard. Test keys never move real money.
2. Download the processor's test card table. Pick at least three cards: one that accepts any CVV, one that declines on a CVV mismatch, and one flagged for a missing security code.
3. Move credentials into environment variables. Reference them through CI secrets. Keep keys out of the repository and out of test output.
4. Scaffold the test project. Run npm init -y, then install Playwright and download the browser binaries with npx playwright install.
5. Build a CVV fixture file. Include a valid three-digit value, a valid four-digit value for Amex, a two-digit value, an alphabetic value, and an empty string.
6. Choose a stable selector for the field. Prefer autocomplete="cc-csc" or the hosted iframe over a class name generated by a bundler.
7. Wrap hosted fields in a frame locator. Stripe Elements and Braintree hosted fields render inside an iframe, so target the frame first and then the input inside it.
8. Fill card number and expiry from the same test card. Keep all fields tied to one fixture so the scenario stays internally consistent.
9. Submit the form the way a shopper would. Click the pay button and wait for the network response rather than a fixed timeout.
10. Assert on the API response. Check the charge status, the decline code, and the returned token. A green on-screen message alone proves nothing.
11. Add the negative cases. Rerun the flow with the two-digit, alphabetic, and empty CVV values and confirm the form blocks submission before any network call.
12. Run the suite headless in CI. Fail the job on any assertion error and archive traces for failed runs.
13. Refresh fixtures every quarter. Processors add and retire test cards, and a stale list produces false failures that erode trust in the suite.

What to assert

• The field rejects input shorter than the required length for the card brand.
• Non-numeric characters are stripped or blocked.
• A mismatched CVV returns the processor's expected decline code.
• No CVV value appears in application logs, analytics events, or error reports.
• The token returned on success is single-use and cannot be replayed.

What never belongs in the suite

Live keys, production endpoints, real card numbers, and stored security codes are all out of scope. PCI DSS treats the CVV as sensitive authentication data and forbids retaining it after authorization, so a test that writes a CVV to a database or a log file creates a compliance problem rather than catching one. Test data stays synthetic, and the sandbox stays isolated from production infrastructure.

cvv testing automation