Payment Card Test Instructions: Sandbox Test Card Guide

Payment card test instructions are the documented steps a developer follows to send a transaction through a payment processor's sandbox using card numbers the processor publishes for testing. They confirm that charges, declines, refunds, and authentication prompts behave correctly before live traffic reaches the gateway. Every number used is a fake, publicly issued test credential, not a real cardholder account.

more on this topic

What are payment card test instructions?

They are the combination of a test card number, any future expiry date, an arbitrary CVV, and a sandbox API key. Processors publish these values so engineers can exercise checkout code repeatedly without moving real money. Sandbox transactions never reach the card networks.

read more

Which test card numbers do processors publish?

• Stripe: 4242 4242 4242 4242 completes a Visa charge, 4000 0000 0000 0002 returns a generic decline, and 4000 0025 0000 3155 triggers 3D Secure.
• Adyen, PayPal, and Braintree publish their own test PANs inside each developer portal.
• Expiry, CVC, and postal code fields accept any well-formed value in test mode.

How do you test declines and error states?

Each processor maps specific test numbers to specific response codes such as insufficient funds, expired card, or incorrect CVC. Calling those numbers on purpose lets you verify that your error copy, retry logic, and webhook handlers work. A checkout that only ever sees approvals is untested.

read more

What are the rules for using test card data?

Test numbers are public and carry no risk because they belong to no one. Real card numbers are governed by PCI DSS, and running a live PAN through a sandbox violates processor terms and card network rules. Never enter a real customer's number into a test environment, and keep production data tokenized.

Should you ever test with a live card?

Only with the cardholder's explicit consent and only through the processor's approved live verification flow. Attempting to determine whether a card number you did not lawfully obtain is active is card testing, it is illegal in the United States and most other jurisdictions, and it triggers fraud scoring that quickly disables the account. This guide covers sandbox credentials only.

Step by step sandbox test

1. Switch your API keys to test mode.
2. Load a published test card number from your processor's documentation.
3. Submit the payment and inspect the response object.
4. Repeat with a decline number and a 3D Secure number.
5. Confirm refunds and webhooks land in your test dashboard.