Authorize.Net Test CVV: Sandbox Card Codes Explained

Any 3-digit value works as a CVV in the Authorize.Net sandbox, and any 4-digit value works for American Express test cards. The sandbox does not check the card code against a real issuer, so 123 and 1234 return normal approvals on the standard test card numbers. The CVV field matters in testing when you want to see how your code reacts to a card code mismatch, a missing code, or a code the issuer cannot verify.

Which CVV do you use with Authorize.Net test cards?

Use 123 for Visa, Mastercard, Discover, JCB, and Diners Club test cards. Use 1234 for the American Express test card. The value is not compared to anything in test mode, so any digits of the right length pass.

• Visa: 4111111111111111, CVV 123
• Mastercard: 5424000000000015, CVV 123
• American Express: 370000000000002, CVV 1234
• Discover: 6011000000000012, CVV 123

Format rules from production still apply. Send 3 or 4 digits, no spaces, and pass the value as a string so a leading zero survives. An empty field is not the same as a valid code, and the gateway reports it as a different result.

Where does the card code go in an Authorize.Net request?

AIM and Direct Post

AIM uses the field x_card_code. Direct Post adds the same value to the form it posts to the gateway. Both carry the CVV inside the transaction request, so it never lands in your own database.

JSON API and Accept.js

The JSON API nests the value as cardCode inside payment.creditCard. Accept.js and Accept Hosted tokenize the card before the request reaches your server, which keeps the CVV out of your logs.

Sandbox endpoints

Test traffic goes to the sandbox host, not the production host. The JSON endpoint is https://apitest.authorize.net/xml/v1/request.api and the AIM endpoint is https://test.authorize.net/gateway/transact.dll.

What does the card code response mean?

The transaction response carries one letter for the card code result. Your integration decides what to do with each letter.

• M: match, the code checks out
• N: no match
• P: not processed
• S: the code should have been present but was missing
• U: the issuer could not process the check
• X: card code not applicable to this card or transaction type

Authorize.Net returns these letters in AIM field 39 and in the JSON API transaction response. In the sandbox, an M shows up for the plain test cards with any 3 or 4 digit code you send.

How do you test a CVV mismatch?

1. Sign in to the sandbox Merchant Interface at sandbox.authorize.net.
2. Open the Card Code Verification settings and turn the check on.
3. Decide whether a mismatch declines the transaction or flags it.
4. Submit a transaction with a test card number that Authorize.Net maps to a card code mismatch. The current list lives in the testing guide, and the numbers for these cases change over time.
5. Read the response code and the single-letter card code result in the reply.

Old forum posts quote card numbers for each failure case. Treat those with care, because Authorize.Net has revised the list more than once. Pull the number from the current guide on the developer site instead.

Why does a sandbox transaction fail when the CVV looks fine?

• The account requires a card code and the request sent an empty field.
• The token already carried the card code, and you sent it a second time.
• The card number belongs to a different test case than the one you wanted.
• The request went to the production endpoint with sandbox credentials, or the reverse.
• The gateway flagged a duplicate. Same card, same amount, and same invoice number inside the duplicate window returns a duplicate error, not a card code error.

Does test CVV behavior match production?

No. In production the issuer decides, and a mismatch can decline the charge or pass through with a flag, based on your account settings. The sandbox skips the issuer step, so it cannot reproduce issuer-side results such as U.

PCI DSS bars storing the card verification code after authorization, in test data and live data alike. Never write x_card_code or cardCode to a log file, and never put a full test card number in a ticket where a real one could be mistaken for it.

FAQ

Is 123 always accepted as an Authorize.Net test CVV?

For the plain success test cards, yes. Cards that Authorize.Net maps to a specific failure return their mapped result no matter which digits you send.

Can I use a real card number in the sandbox?

Do not. A real number in the sandbox does not reach an issuer, and the test account is not built for it.

What CVV goes with the Amex test card?

1234. American Express uses a 4-digit code, and the length check still applies in test mode.

Why does my test transaction return N for the card code?

The card number you used is one that Authorize.Net maps to a no-match result. Swap it for a plain test card if you wanted an approval.

Do I need to enable Card Code Verification before the CVV field counts?

Yes. If the setting is off in the Merchant Interface, the gateway skips the check and the card code response stays empty.