The short answer

An Authorize.Net test card is a card number that works only inside the Authorize.Net sandbox, a closed testing environment that never touches a live card network. You do not buy test cards. You get them free from the gateway's own developer documentation the moment you create a sandbox account. If someone offers to sell you "Authorize.Net test cards," they are not selling test data, because test data has no resale value and cannot be charged. Treat that offer as a red flag.

The practical takeaway for anyone integrating payments: generate a sandbox account, pull the published test card list, and run your integration against it. Spend your budget on development time and a PCI-aware hosting setup, not on card numbers.

How to get a working test setup

  1. Register for a sandbox account through the Authorize.Net developer portal. Sandbox and production accounts are separate, and credentials do not carry over.
  2. Copy your sandbox API Login ID and Transaction Key. In the sandbox these are generated for you and can be rotated at will.
  3. Create a test customer profile or use a direct payment call, depending on which API you plan to ship.
  4. Run a charge with one of the documented test card numbers and confirm the response reason code matches what the documentation predicts.
  5. Repeat the same calls in production later with a real merchant account. Nothing about the sandbox test numbers will work there.

What to look for in a test card set

  • Card brand coverage. A useful set includes Visa, Mastercard, American Express, Discover, and at least one JCB or Diners number so your brand icons and card type detection get exercised.
  • Decline paths. Approval-only testing hides bugs. You want documented numbers that return specific response reason codes for declines, holds, and errors.
  • Address Verification Service results. Test numbers paired with specific street and ZIP values let you confirm your AVS handling, including partial matches and the no-match case.
  • Card code results. The same applies to the three or four digit card code. Confirm that a mismatch routes to the outcome your business rules expect.
  • Reversal and refund behavior. Void and refund flows behave differently before and after settlement, so test both sides of the cutoff.
  • Recurring and profile support. If you plan subscriptions, verify that test cards can be stored in a customer profile and charged on a schedule.

Parameter bands that matter

Test numbers are grouped by brand prefix. Visa test numbers begin with 4, Mastercard with 5 or 2, American Express with 34 or 37, and Discover with 6011. Those prefixes are reserved for testing, which is why they decline on live networks.

Expiration dates in the sandbox should be a future month and year. Any future date is normally accepted, and the sandbox does not validate against real issuer records. Use the format your API expects, usually a four digit year.

Card codes are three digits for most brands and four for American Express. The sandbox accepts well formed values and lets the documented test numbers drive the result code.

Amount is a parameter people overlook. Authorize.Net documents specific amounts that trigger specific response reason codes, so a one dollar charge and a test amount tied to a decline case can return opposite results even with the same card number.

Pitfalls to avoid

  • Never place production credentials or live card numbers in a sandbox or staging environment. That violates PCI DSS expectations about test data.
  • Do not assume a sandbox approval means your production account is configured. Gateway settings, merchant descriptors, and processor rules are separate.
  • Do not treat every sandbox decline as an integration bug. Check the response reason code first, then your code.
  • Do not store test card numbers as if they were real payment data. It trains your team to handle PANs casually.
  • Do not rely on a single test card. Bugs surface when brand rules, AVS, and card code checks interact.
  • Do not buy card data from any source. Possessing stolen numbers is a crime in every US jurisdiction and carries real prison exposure.

FAQ

Do Authorize.Net test cards work in production?

No. They are reserved test numbers and will be declined by any live processor.

Are test card numbers safe to share with a contractor?

Yes. They are published, they cannot be charged, and they carry no cardholder identity.

Why does a documented test card return a decline for me?

Check the amount, the expiration date, and the card code you sent. Several test numbers are designed to decline so you can exercise your error handling.

Can I test Apple Pay, Google Pay, or 3D Secure in the sandbox?

Wallet and authentication flows need their own sandbox setups from the wallet provider or directory server, in addition to your Authorize.Net credentials.

How long does sandbox access last?

Sandbox accounts stay available while they are in use. Clean out old test transaction data periodically so reports stay readable.