The Braintree test CVV is 123 for Visa, Mastercard, Discover, and JCB, and 1234 for American Express. Send it with any documented Braintree sandbox card number and a future expiration date to get a successful authorization. To test a failed CVV check, use 200 instead.
Does CVV 123 work with every Braintree test card?
Braintree publishes a fixed set of sandbox card numbers, and each one pairs with the CVV length its brand uses in production. Matching that length keeps your test close to live behavior.
- Visa 4111 1111 1111 1111: CVV 123
- Mastercard 5555 5555 5555 4444: CVV 123
- American Express 3782 822463 10005: CID 1234
- Discover 6011 1111 1111 1117: CVV 123
- JCB 3530 1113 3330 0000: CVV 123
Any future expiration date works. A past date fails before the CVV is evaluated, which is the most common reason a sandbox test looks broken.
How do you simulate a failed CVV check in the sandbox?
Braintree maps a few CVV values to specific verification results so you can exercise your decline handling without guessing.
- 123: CVV matches
- 200: CVV does not match
- 201: CVV not verified by the issuer
- 202: issuer does not participate in CVV checks
Re-check the current list on Braintree's test values page before you hard-code assertions around it, since sandbox behavior can change.
Does the Braintree sandbox really validate the CVV?
No. Sandbox transactions never reach a real issuer, so the CVV is compared against Braintree's documented test values rather than the cardholder's actual data.
CVV verification also has to be enabled in the Control Panel under Settings, then Processing, then CVV, for the field to be evaluated at all. With that rule off, the gateway accepts whatever you send and the CVV result comes back empty.
Why is Braintree rejecting your test CVV?
- Wrong length for Amex. A 3-digit value returns validation error 81707, because Amex needs 4 digits.
- Empty CVV while card verification is required. The API returns a CVV required error.
- Expired card date. Use a month and year in the future.
- Type mismatch. Send the CVV as a string, since casting it to an integer strips a leading zero.
- Live card number in the sandbox. Non-test numbers are declined by the processor.
Can you skip the CVV entirely during testing?
Yes. Test nonces such as fake-valid-nonce or fake-valid-visa-nonce create a payment method without any card fields, CVV included. Use them for checkout flow, vaulting, and subscription tests where card verification is not the thing under test.
Reserve the raw card-number-plus-CVV path for cases that actually assert on CVV results.
Should you ever test with a real card number?
No. Real card data in a sandbox creates a PCI scope problem and is unnecessary, because Braintree's test numbers already cover the responses you need. Keep live cards and production keys out of development environments.
Remember that the CVV is passed through for verification and never stored, so it cannot be retrieved or re-used after the authorization call.