Adyen's sandbox Visa number, 4111 1111 1111 1111, is the top pick for most integration tests. Pair it with any future expiry date and any three-digit CVC, and Adyen returns a successful authorization through its standard card flow. The pick rests on four criteria: the number must be accepted only in the test environment, it must match a scheme you actually accept, it must let you force a specific refusal or error code, and it should exercise both frictionless and challenge 3D Secure paths.
What an Adyen test card is
An Adyen test card is a published card number that only the Adyen test environment recognizes. You send it through the same API calls, checkout components, and webhooks you use in production, but the authorization is simulated instead of routed to a real issuer. No funds move and no cardholder is involved. Because the numbers are public, they are safe to commit to a test suite, paste into an API client, or hand to a QA team.
Adyen maintains a current list of these numbers in its test card documentation, and it revises the list when schemes change behavior. Treat the published list as the source of truth rather than a number copied from a forum post.
The default success card
For a plain successful payment, the Visa test number above is the one most teams start with. It works with a standard authorised result, it behaves correctly with CVC and expiry validation turned on, and it does not require extra configuration.
Pros
- Accepted across Adyen's standard card payment flow with no special setup.
- Works with mocked CVC and expiry checks, so you can test validation rules around it.
- Public and stable, which makes it safe to hardcode in an automated test suite.
Cons
- Returns success only. It tells you nothing about how your code handles a decline.
- Does not by itself prove that your 3D Secure branch runs.
- Confirms nothing about schemes you have not enabled on the account.
Use it for smoke tests, demo environments, and the first pass through a new checkout component. Do not stop there.
Cards that force a refusal or an error
Adyen also documents test numbers that produce specific outcomes, so you can exercise the sad path on purpose. Some return a refusal, which arrives in the response as a refusal reason you can map to a customer-facing message. Others trigger an error result, which stands in for a processing failure rather than a customer problem. The distinction matters, because a refusal usually means show the shopper a retry path and an error usually means log it and alert someone.
Add at least one of each to your regression suite. Teams that only test the success card tend to discover their error handling is broken in production, at the worst possible moment.
3D Secure test cards
The test environment simulates EMV 3-D Secure, and different cards drive different flows. Some authenticate without any shopper interaction, which Adyen returns as a frictionless outcome. Others force a challenge, where your integration has to handle the authentication step and then complete the payment with a follow-up call. Test both, plus the case where the shopper abandons the challenge window, because that abandoned state is where real integrations most often leak orders.
Scheme and local payment method coverage
Test cards exist for the major card schemes, and Adyen names each one clearly. Local payment methods work differently: instead of a card number you get a simulated flow or a magic value that pushes the payment to a chosen outcome. Read the documentation for each method rather than assuming a card number will stand in for it.
Pitfalls that break a test run
- Mixing a test API key with the live endpoint, or the reverse. The request fails before any card logic runs.
- Using an expiry date that has since passed, which turns a success test into an expiry validation error.
- Leaving CVC checks enabled while supplying a blank value, then blaming the card.
- Testing only the success card and shipping untested decline handling.
- Caching a 3D Secure result between runs and assuming the challenge step executed.
Handling card data safely in test builds
Test numbers belong in the test environment, and real card numbers never belong anywhere in a repository or a log. The PCI Security Standards Council is explicit that sensitive authentication data, including the card verification code, must not be stored after authorization. A sandbox is not a loophole. Keep production credentials out of local configs, and make sure your logging layer masks the CVC field before it reaches disk.
Recommendation
Start with the standard Visa test number to prove the happy path end to end. Then add a refusal card, an error card, and at least one 3D Secure challenge card to the same suite, so a single test run covers success, decline, failure, and authentication. That combination catches the bugs that a success-only test plan always misses.