Braintree Test Card Numbers: Sandbox Testing Guide

A Braintree test card is a fake card number that only works in the Braintree sandbox, never in production. You pair it with a future expiration date and any 3-digit CVV (4 digits for American Express) to run an approval, or you set a specific test amount to force a decline. The standard Visa number is 4111 1111 1111 1111.

Which Braintree test card numbers work in the sandbox?

Braintree publishes a set of sandbox card numbers that cover the major card brands. Each one returns an approval when you charge a normal amount.

• Visa: 4111 1111 1111 1111
• Visa debit: 4012 8888 8888 1881
• Mastercard: 5555 5555 5555 4444
• Mastercard debit: 5105 1051 0510 5100
• American Express: 3782 822463 10005
• Discover: 6011 1111 1111 1117
• JCB: 3530 1113 3330 0000
• Diners Club: 3056 9300 0900 04

Braintree updates and regionalizes this list, so check your Control Panel under Settings, then Processing, before you hardcode a number. A card that approves on one merchant account can behave differently on another.

What expiration date and CVV should you use with a test card?

Any future expiration date passes. Pick something far out, like 12/2030, so your test suite does not break next year.

For CVV, any 3 digits pass on Visa, Mastercard, Discover, and JCB. American Express wants 4 digits. A wrong CVV does not always fail in sandbox, so test that path on purpose with the amount triggers below.

For AVS, a postal code of 12345 and a street address like 123 Main St return a match in most sandbox setups.

How do you force a decline or a CVV failure?

Braintree maps certain test amounts to processor responses. Charge that exact dollar amount in the sandbox and the gateway returns the matching code instead of an approval.

• $2000.00 returns Do Not Honor.
• $2001.00 returns Insufficient Funds.
• $2002.00 returns Limit Exceeded.
• $2003.00 returns Cardholder Activity Limit Exceeded.
• $2004.00 returns Expired Card.
• $2005.00 returns Invalid Credit Card Number.
• $2006.00 returns Invalid Expiration Date.
• $2007.00 returns No Account.
• $2008.00 returns Card Account Length Exceeded.
• $2009.00 returns Invalid Payment Method.
• $2010.00 returns Card Issuer Declined CVV.

The table runs further into the 2010s and 2020s with fraud, lost card, and stolen card triggers. Amount triggers shift with processor and country, so confirm each code against the current Braintree docs before you write assertions around it.

Do Braintree test cards work in production?

No. Live processors reject these numbers, and Braintree marks them as sandbox-only. If an order approves with 4111 1111 1111 1111 on a live account, your environment config is wrong.

Test cards exist for your own integration work. Running real card numbers you do not own is a crime in the US and most other countries, and it proves nothing about your code.

How do you set up a Braintree sandbox to use them?

1. Create a Braintree account, then add a sandbox account from the Control Panel.
2. Copy the sandbox merchant ID, public key, and private key into your environment variables.
3. Point the SDK at the sandbox environment. In the Node, Python, Ruby, and Java SDKs this is one environment flag.
4. Run a $1.00 sale with a test card and confirm the transaction lands in the sandbox vault.
5. Switch the amount into the 2000s to test your decline handling.

How do you test 3D Secure with Braintree?

Braintree ships a separate set of sandbox cards for 3D Secure. One number returns a clean authentication, another forces a challenge, and a third fails the challenge.

Keep those numbers in a fixture file next to your regular test cards. The 3DS flow adds an iframe or a redirect step, so a unit test that mocks the gateway will miss callback and layout bugs.

Which cases should you cover before launch?

• Approval with a normal amount.
• Hard decline (Do Not Honor) and soft decline (Insufficient Funds).
• CVV mismatch and AVS mismatch.
• 3D Secure challenge plus the failed authentication path.
• Network timeout and gateway 500 responses.
• Duplicate submissions and idempotency keys.
• Refund, partial capture, void, and settlement.

How do you keep test card numbers out of production code?

Store sandbox numbers in test fixtures, never in the same file as live credentials. One environment flag should decide which set your app loads.

Add a startup check that refuses to boot if a sandbox merchant ID appears next to production API keys. That single guard stops the most common mix-up.

Frequently asked questions

Can I use a real credit card in the Braintree sandbox?

You can, and no money moves, but results vary and the card is not validated. Test cards give you repeatable outcomes, which is what automated tests need.

Why does my test card keep getting declined in the sandbox?

The amount is the usual cause. Anything in the 2000s triggers a processor response by design. Check the amount first, then confirm your API keys point at sandbox and not production.

Does the CVV matter on a Braintree test card?

Any 3 digits work for an approval. To test a CVV failure, use the amount that maps to Card Issuer Declined CVV, or a card number Braintree documents for that response.

Are these numbers the same at Stripe, Authorize.Net, and Square?

Many overlap because they come from the same card brand test ranges. The decline triggers differ by gateway, so do not copy an amount list from one processor to another.