PayPal sandbox test cards are fixed card numbers that work only inside the PayPal sandbox environment. You type one into a sandbox checkout to simulate a card payment without touching a live account or a real card. The standard set is 4111111111111111 (Visa), 5555555555554444 (Mastercard), 378282246310005 (American Express), and 6011111111111117 (Discover). Pair each number with any future expiry date, a CVV of 123 (1234 for American Express), and any cardholder name.

Prerequisites

  • A PayPal Developer account
  • At least one sandbox business account and one sandbox personal account
  • Sandbox API credentials for the app you are testing
  • A checkout that points at the sandbox endpoint, not the live one

Set up the sandbox before you test

  1. Sign in to the PayPal Developer dashboard.
  2. Open the Sandbox menu and choose Accounts.
  3. Confirm you have a business account for the merchant side and a personal account for the buyer side.
  4. Open Apps and Credentials and select the app you will test.
  5. Copy the sandbox client ID and secret into your test configuration.
  6. Confirm your integration base URL points at the sandbox host.

Card numbers the sandbox accepts

  • Visa: 4111111111111111, CVV 123
  • Mastercard: 5555555555554444, CVV 123
  • American Express: 378282246310005, CVV 1234
  • Discover: 6011111111111117, CVV 123

PayPal updates and extends this list, so check the test card reference in the developer docs before you build a test suite around specific numbers.

Run a test card payment

  1. Start your checkout in a browser session that is not signed in to a live PayPal account.
  2. Choose the debit or credit card option.
  3. Enter a test card number from the list above.
  4. Enter a future expiry date such as 12/2030.
  5. Enter the matching CVV and any cardholder name.
  6. Submit the payment.
  7. Open the sandbox business account and confirm the transaction appears with the expected status.

Trigger failures on purpose

  1. Repeat the checkout with a past expiry date to test your decline path.
  2. Submit a CVV that does not match the card type length.
  3. Use a card number that fails the Luhn check to confirm client-side validation fires.
  4. Send the same request twice to see how your code handles a duplicate.
  5. Log the response code and the message your UI shows for each case.

Common mistakes

  • Sending sandbox credentials to the live endpoint, which returns authentication errors instead of a payment.
  • Reusing a live PayPal login in a sandbox checkout, which mixes real and test state.
  • Hard-coding one card number and never testing a second card brand.
  • Assuming a passing sandbox payment proves a live account is approved for card processing.

What never works

Sandbox card numbers are test data. They decline on any live gateway, and a live card number must never be entered in a test system. Card data belongs in an approved environment under PCI DSS rules, and storing real card numbers in a test database is a compliance failure even when no charge succeeds. Keep all card testing inside the sandbox, keep test credentials separate from production secrets, and rotate any credential that leaks into a test branch.