PayPal Sandbox CVV: Test Mode Rules Explained

The short answer

In the PayPal sandbox, the CVV is whatever you type. The simulator does not check it. As long as the card number matches a card on PayPal's published test list and the expiry date is in the future, you can enter 123, 000, 999, or any other digits and the sandbox will still approve the payment. Amex test cards want four digits; everything else wants three. That is the whole rule.

paypal sandbox cvv tutorial

Nothing you type into a sandbox CVV field touches a bank, an issuer, or a real cardholder. It is test data living inside a closed simulator.

PayPal Sandbox CVV Overview Guide

Why the sandbox skips the CVV check

CVV verification is an issuer-side check. When a live transaction runs, the payment gateway passes the code to the card network, the network asks the issuing bank, and the bank compares it to what it has on file. In sandbox mode there is no issuer to ask. PayPal routes the request to a simulator instead, and the simulator decides the outcome from the card number pattern alone.

how to paypal sandbox cvv

That is why the sandbox returns approved for a card ending in a known test pattern and declined for a card that PayPal lists as a failure scenario. The CVV field stays in the form because your integration needs it to behave like the real thing, not because anything validates it.

Test cards you will run into

PayPal publishes its own sandbox card list, and it varies by region and product. You can find the current numbers in the developer dashboard under Sandbox Accounts and in the card testing docs. A few numbers show up almost everywhere:

• Visa: 4111111111111111 is the classic test PAN and works in most PayPal sandbox setups.
• Mastercard: 5555555555554444.
• Amex: 378282246310005, which requires a four-digit CVV.
• Discover: 6011111111111117.

PayPal also ships cards that force specific outcomes, so you can test the decline path on purpose instead of guessing. Those are the ones worth wiring into your test suite.

Expiry and CVV rules

Expiry must be a future date. Some card field components reject past dates locally before they ever reach the API, which is a nice way to confirm your date picker works. The CVV must be filled in, and it must be the right length for the brand. The JavaScript SDK will keep the submit button disabled until that field has content.

Sandbox CVV versus a live CVV

A live CVV belongs to a real account and is regulated sensitive authentication data. A sandbox CVV is a string of digits with no value outside the test environment. If you point sandbox credentials at a live endpoint, you get a rejection, not an authorization. Production systems run the real check, and test PANs fail there every time.

It is worth saying plainly: a CVV that only works in a sandbox has no use against a live payment page. People who search for sandbox CVVs hoping to find something usable in production are looking at the wrong door. Test data stays test data.

Where the CVV field still matters in testing

Plenty, actually. During integration I use the sandbox CVV field to check formatting and error handling. Does the form accept four digits for Amex and three for Visa? Does the error copy read well when the field is blank? Does a simulated CVV decline from the sandbox trigger the retry and decline screens I built? Does my logging accidentally capture the code? That last one is the check people skip.

Common mistakes

• Using a real card number in the sandbox. That violates your merchant agreement and PCI DSS. Use test PANs only.
• Expecting sandbox numbers to work on live. They will not.
• Hardcoding 123 and forgetting Amex needs four digits.
• Assuming the sandbox validates AVS against a real address. It can simulate results, but there is no real address behind it.
• Letting sandbox API keys ship to production.

Quick checklist

1. Confirm which sandbox card list your region and product use.
2. Test a three-digit CVV path and a four-digit Amex path.
3. Force at least one decline and check your UI response.
4. Verify the CVV never lands in logs, analytics, or your database after authorization. PCI DSS forbids storing it.
5. Keep sandbox keys in environment variables, separate from live ones.

Get those five right and the CVV field stops being a mystery. It is a form element in a simulator, and it behaves exactly like one.