PayPal Sandbox CVV Details: Test CVV Codes Explained

PayPal's standard sandbox checkout never asks for a CVV. Test CVV details only matter when you exercise card payments through PayPal Advanced Credit and Debit Card Payments or Braintree, and there any 3-digit CVV (4 digits for American Express) is accepted alongside PayPal's published sandbox test card numbers.

paypal sandbox cvv guide

Does the PayPal sandbox require a CVV?

No. When you sign in with a sandbox personal or business account at the PayPal sandbox checkout, the flow uses an email, a password, and a simulated balance. No card number and no CVV field appear.

PayPal Sandbox CVV Explanation

A CVV field shows up only in card testing flows, such as hosted fields on Advanced Credit and Debit Card Payments or a Braintree drop-in UI. In those flows the CVV is checked against test rules instead of a live issuer.

PayPal Sandbox CVV Instructions

Which CVV do you use with PayPal sandbox test cards?

Use 123 for Visa, Mastercard, Discover, and JCB, and 1234 for American Express. Any CVV of the correct length normally passes, because the sandbox does not verify it against a bank.

• Visa: 4111 1111 1111 1111, CVV 123
• Mastercard: 5555 5555 5555 4444, CVV 123
• American Express: 3782 822463 10005, CVV 1234
• Discover: 6011 1111 1111 1117, CVV 123
• JCB: 3566 0020 2036 0505, CVV 123

Set the expiration date to any future month and year. A past date is the most common reason a sandbox charge fails before the CVV check even runs.

How do test CVV values trigger specific responses?

Braintree, PayPal's card processing stack, maps certain CVV inputs to specific verification results. This lets you test your own decline and not-verified messaging without touching a live card.

• 200: CVV matches
• 201: CVV does not match
• 301: CVV not verified

Confirm the current list in Braintree's testing reference before you hardcode it, since PayPal updates sandbox behavior without notice.

What is the test CVV for 4111 1111 1111 1111?

Use 123. That value pairs with the Visa sandbox number in PayPal and Braintree test environments and returns a successful CVV match in most configurations.

Why does a sandbox CVV get rejected?

• Using a live card in the sandbox instead of a documented test number
• Entering the wrong CVV length for the card brand, 3 digits versus 4
• Leaving AVS fields blank when the test card expects a matching postal code
• Testing against a live merchant account instead of the sandbox account

Nearly every rejection traces back to one of those four causes, not to the CVV value itself.

Can you retrieve a CVV from the sandbox API?

No. A CVV is never returned in an API response, a webhook payload, or a transaction record, even in the sandbox. PCI DSS rules forbid storing sensitive authentication data such as a CVV after a transaction is authorized.

Your integration should pass the CVV straight through to the processor and store only the verification result, for example a match or mismatch flag.

Is testing with sandbox CVV values legal?

Yes. Sandbox card numbers and their CVVs are published by PayPal for developer testing and carry no real account data. The line is production: entering a real card number or CVV that you do not own is card fraud, not testing.