Braintree Test CVV: Sandbox CVV Values Explained

A Braintree test CVV is the dummy security code you enter alongside a sandbox test card number while building an integration. In the Braintree sandbox, ordinary test cards accept almost any 3-digit CVV, and American Express test cards accept 4 digits, while a small set of published test numbers exists to force a CVV verification failure so you can exercise your error handling.

How CVV fits into a Braintree sandbox payment

Braintree separates the card number, the expiration date, and the CVV when it tokenizes a payment method. The CVV never gets stored on your servers, and in the sandbox it never reaches a real card network. When you request a payment method nonce with the verifyCard option enabled, Braintree runs CVV and address verification checks against the test number first. Without that option, the sandbox still accepts the card, but the verification results stay empty.

Which CVV value should you type?

• Standard success cards: enter any 3-digit value such as 123 for Visa, Mastercard, Discover, or JCB test numbers.
• American Express: enter any 4-digit value such as 1234, because Amex prints a 4-digit code.
• Failure cases: use the specific test card that Braintree documents as producing a CVV mismatch instead of guessing at a magic CVV.
• Blank field: leaving the field empty in Drop-in or Hosted Fields usually returns a validation message before the request ever reaches the processor.

Always pull the current pairs from the official test card table, since values are occasionally adjusted and the table is the only reliable source for which number triggers which response.

Testing a CVV failure on purpose

A CVV failure is a normal outcome, not a bug. To reproduce one, submit the test card that is documented as failing CVV verification with verifyCard set to true. Braintree then returns a CVV response code along with the result, and the common values you will see are M for a match and N for no match. Your checkout should treat an unmatched CVV as a decline that the shopper can retry with a corrected code, and you should log the response code rather than the code the shopper typed.

Reading the response

• cvv_response_code on the verification result tells you whether the code matched.
• The transaction status and processor response text explain whether the gateway declined or the issuer did.
• Address verification results arrive in the same response, so you can test both checks together.

Common Braintree test CVV problems

• Card declined with a valid code: you may be using a real card number in the sandbox, or an expired test expiration date.
• No CVV result returned: verifyCard was not requested, so no verification ran.
• Hosted Fields rejects the input: the field is length-checked, so 4 digits will fail on a non-Amex card type.
• Results look inconsistent: you are likely mixing numbers from two different test tables.

Keep real card data out of the sandbox

Sandbox environments exist so that no live account number, and no real CVV, is ever typed into a test form. Storing a card verification value after authorization is prohibited by the card network rules, and using live data in a test account creates a compliance problem for your business. Keep the test numbers in a shared fixture file, rotate them when the documentation changes, and confirm that your production keys are never loaded in a development build.