The Short Answer

Use test CVV values for every sandbox, staging, and demo checkout. Real card numbers and their card verification values belong in a live production environment only, behind a PCI-compliant integration. Start with test values, confirm your form, tokenization, and decline handling work, then move to real cards when you are ready to settle funds.

read more

Prerequisites

  • A sandbox or test-mode account with your payment processor
  • Test API keys, separate from live keys
  • The processor's published test card list
  • A written note of which team members can touch live keys

How to Test a Checkout Form, Step by Step

  1. Pull a test card number from your processor's developer documentation.
  2. Pair it with the matching test CVV listed next to that card number.
  3. Set the expiry date to a future month and year.
  4. Submit the form against the sandbox endpoint, not the live endpoint.
  5. Repeat with the documented decline CVV to confirm your error path.
  6. Check that the CVV field is never written to your logs or database.
  7. Switch to live keys only after the decline and success paths both pass review.

Option 1: Square Sandbox Test Values

Square publishes test card numbers and CVV values for its test environment. These values never reach a real issuer, so a transaction either approves or declines based on the rules Square set. Use them to confirm your form validation, error messaging, and webhook handling. The numbers are short lived in the sense that Square can revise the deck, so check the docs before you hardcode anything into a test suite.

related square test cvv vs real card numbers

Option 2: Other Gateway Test Decks

Stripe, Authorize.Net, and most other processors publish their own test card lists. The pattern is similar, but the decline triggers differ. If you support more than one processor, keep each deck in a separate fixture file with a comment naming the source and the date you copied it.

How to Use Longtail Square Test CVV for Payment Acceptance

Option 3: Real Card Numbers (Live Only)

A real CVV is a 3-digit code for most cards and a 4-digit code for American Express. It exists to prove the person holding the card has the physical card or the account. You cannot test with a real CVV in a sandbox because the sandbox does not talk to the issuer network. Real numbers go into live endpoints, and PCI DSS limits how long you may store the verification value after authorization. In most cases the answer is: do not store it at all.

Square Test CVV: Everything You Need to Know

Format Rules That Trip People Up

  • American Express uses a 4-digit code, not 3.
  • Test decks often use a fixed value such as 000 or 999 to force a decline.
  • Address and ZIP checks run as separate rules from the CVV check.
  • A passing CVV check does not guarantee the card has funds.

Common Mistakes

  • Mixing sandbox test values with live API keys
  • Logging the CVV field during debugging
  • Assuming one gateway's decline CVV works on another gateway
  • Shipping to production with the test deck still wired into the form defaults

Compliance Note

Sensitive authentication data, which includes the CVV, falls under PCI DSS storage rules. Keep it out of databases, analytics tools, and support tickets. Test values are not sensitive authentication data, which is the main reason they are safe to paste into a shared test fixture.