Sandbox CVV: Test Card Verification Values Explained

What a sandbox CVV is

A sandbox CVV is a placeholder card verification value used with test card numbers inside a payment gateway's sandbox. It exists so developers can exercise checkout flows, authentication prompts, and decline handling without touching a real card. It never authorizes a charge and has no value outside the test environment.

Sandbox CVV vs. a live CVV

A live CVV is the three- or four-digit code printed on a real card and tied to that account. A sandbox CVV is arbitrary test data. Gateways treat it as a pass or fail trigger, not as a secret. Test values are published in developer documentation, which makes them safe to paste into a test suite and unsafe to confuse with production credentials.

Common sandbox values by gateway

Stripe

Stripe test cards accept any three-digit CVC. The number 4111 1111 1111 1111 with a future expiry and any CVC succeeds in test mode. Specific CVC values trigger declines so you can test error paths.

PayPal and Braintree

Sandbox accounts come with generated card numbers. The CVV field accepts the test value shown in the sandbox dashboard. A mismatched value returns a CVV failure response.

Authorize.net

The sandbox uses separate test credentials and a fixed set of test card numbers. CVV results are simulated through the test account, and no funds move.

How to test CVV handling in a sandbox

1. Create a sandbox account with your payment provider and copy the test API keys.
2. Select a published test card number for the card brand you need to cover.
3. Enter a CVV value documented for that card, or any three digits when the gateway accepts a wildcard CVC.
4. Submit a test charge and confirm the response code matches the scenario you want, such as success, CVV mismatch, or issuer decline.
5. Repeat with a wrong CVV to verify your interface shows the decline message and logs the event.
6. Confirm that your application never writes the CVV to a database, log file, or analytics event.

Rules for CVV data in any environment

• Never use real card numbers or real CVVs in a sandbox. Test data only.
• Do not store CVV after authorization in production. PCI DSS forbids it.
• Do not assume a sandbox CVV pass means production will pass. Issuer checks differ.
• Keep sandbox keys out of production builds and rotate them when a team member leaves.

Troubleshooting failed sandbox CVV checks

A CVV failure in a sandbox traces to one of four causes: a test card paired with a CVC the gateway does not recognize, a live key used in a test request, a sandbox account missing the card brand, or a client-side validation rule that blocks three-digit input. Confirm the key prefix, the card number, and the gateway's documented CVC rules before you change code.