What CVV test tokenization v3 means
CVV test tokenization v3 is a sandbox token flow: you send a test primary account number (PAN) and its test CVV to a tokenization endpoint, the processor returns a payment token, and every later CVV check runs against that token instead of raw card data. The v3 label marks a schema where the CVV travels inside a dedicated verification object, the response carries a network token reference, and the CVV value is never echoed in logs, webhooks, or stored rows.
Tokenization is the control that removes card data from your systems, so it is the opposite of handling live numbers. Test with synthetic PANs issued by your processor. Sending real card data into a sandbox, or using card numbers you do not own, is a criminal act under the US Computer Fraud and Abuse Act and a violation of card network rules.
CVV Test Tokenization V9 Guide
Prerequisites
- A processor sandbox account with tokenization v3 enabled for the account.
- The processor's test card list, including approved, declined, and CVV-mismatch cases.
- A sandbox API key scoped to tokenization endpoints.
- An HTTPS webhook endpoint that can accept token and verification events.
- A test database with no production card data in it.
How to run a CVV tokenization v3 test
- Create the sandbox account and confirm tokenization v3 appears in the account capability list.
- Copy the test card list into your test fixtures and tag each entry as approved, declined, or CVV mismatch.
- Generate a sandbox API key for tokenization and store it in your secrets manager.
- Register the webhook endpoint and subscribe it to token creation and CVV verification events.
- Send a tokenization request that carries the test PAN, expiry, and CVV inside the verification object.
- Read the response and confirm it returns a token ID plus a CVV result code, with no PAN or CVV in the body.
- Persist the token ID in the test database and confirm no column stores the CVV.
- Reuse the token in a follow-up authorization call and confirm the API does not ask for the CVV again.
- Replay the same test PAN with a wrong CVV and confirm the response returns the mismatch code.
- Submit a declined test PAN and confirm the error branch in your code fires.
- Search application logs, webhook payloads, and database rows for any PAN or CVV string.
- Swap in production keys and provision network tokens through the live endpoint only after the sandbox suite passes.
Checks that confirm the test passed
- Token response contains an identifier and a CVV check result, nothing more sensitive.
- Webhook payloads reference the token, not the account number.
- Application logs show a masked last-four value at most.
- Wrong-CVV and decline cases route to distinct handling paths.
- Database schema has no CVV, CVC, or CVV2 field anywhere.
Common failures
A 400 response on the verification object usually means the CVV field name does not match the v3 schema. A 402 response on a test PAN means the fixture is tagged as a decline case. A missing token in the response often traces to the account not being enabled for tokenization v3, or to a key created before the capability was turned on.
Compliance notes
PCI DSS requirement 3.2 prohibits storing sensitive authentication data, including the CVV, after authorization, in any form, in any environment. Sandbox testing exists so you can prove your integration never persists that value. If your test requires a real card number, stop and use the processor's synthetic fixtures instead.