Use 123 as the CVV in Authorize.net test mode for Visa, Mastercard, Discover, JCB and Diners Club cards, and 1234 for American Express. The sandbox does not verify the CVV against the real card, so any 3 or 4 digit number passes. Pick one value, keep it constant across your test suite, and never enter a real card's verification code.
What CVV value should I use in the Authorize.net sandbox?
Any 3 digit number works, and 123 is the value most developers use because it is easy to read in logs. American Express test cards expect 4 digits, so 1234 is the matching choice.
Consistency matters more than the specific number. If your automated tests hardcode 123, the same value should appear in manual checks so that screenshots, logs and bug reports line up.
Does Authorize.net check the CVV in test mode?
The test environment validates the format of the card code field but not the value. The API accepts 3 or 4 digits and rejects anything shorter, longer or non numeric with a field validation error before the transaction is submitted.
That format rule is the only constraint the sandbox applies to the CVV. A mismatch decline cannot be forced with a special test number the way it can in some other gateways.
Which test card numbers pair with the test CVV?
Authorize.net publishes a fixed list of sandbox card numbers. These are the common ones used with 123 or 1234:
- Visa: 4111111111111111, 4007000000027, 4012888818888
- Mastercard: 5424000000000015, 5500000000000004
- American Express: 370000000000002, 380000000000006
- Discover: 6011000990139424
- JCB: 3530111333300000
- Diners Club: 30569309025904
Use the sandbox merchant account at sandbox.authorize.net for these numbers. A production account with Test Mode switched on behaves differently and should not be used for card code testing.
What CVV response codes appear in sandbox results?
Sandbox transactions usually return P (not processed) or M (match) in the card code response field, depending on how the account is configured. Do not build application logic that depends on one specific code appearing on every test run.
Your code should handle the full documented set: M for match, N for no match, S for the code that should have been on the card, U for issuer unable to process, and P for not processed.
Why you must never use a real CVV when testing
PCI DSS Requirement 3.2 prohibits storing sensitive authentication data, including the CVV, after authorization in any form. Test data belongs in the sandbox, and production card data belongs nowhere in your logs, fixtures or seed files.
Verification values cannot be bought, sold or shared. A real code is only ever entered by the cardholder at the moment of payment.
Frequently asked questions
Is 123 always accepted as an Authorize.net test CVV?
Yes, in the sandbox and in Test Mode. The value is not checked against an issuer, so 123 behaves the same as 999.
Do I need a CVV if my account marks the field as required?
Yes. When the card code requirement is enabled, omitting the field returns an error or a decline even in test mode. Send a dummy value to keep the transaction path realistic.
Can I test a CVV mismatch decline?
Not by changing the test CVV. The sandbox does not simulate issuer mismatch responses for that field, so test the decline branch with your own mocked response or with a dedicated test card that returns an error code.
Does a 4 digit CVV fail on Visa in the sandbox?
No. The API accepts 3 or 4 digits on any card type, so 1234 on a Visa test card passes validation. Only a length outside that range triggers an error.