The Authorize.Net test CVV value is normally 123 for Visa, Mastercard, Discover and JCB, and 1234 for American Express. The Authorize.Net sandbox does not send the card code to a real issuer for verification, so a test transaction usually approves no matter which 3 or 4 digit number you type. The digits only matter when you want to see a card code mismatch response.

What the CVV field does in Authorize.Net

Authorize.Net calls the security code the card code, or CVV2. You send it in the cardCode field of the payment request. In a live account the processor compares it to the value on file with the issuing bank and returns a single letter result: M for match, N for no match, P for not processed, S for should have been present, and U for unknown.

In the sandbox that comparison is simulated. The gateway has no real issuer to ask, so it applies the card code verification setting on your test account instead of checking the digits against anything.

Test card numbers and the CVV to pair with them

Authorize.Net publishes sandbox card numbers for each brand. Use any future expiration date and the matching card code below.

  • Visa: 4111111111111111 with CVV 123
  • Mastercard: 5424000000000015 with CVV 123
  • American Express: 370000000000002 with CVV 1234
  • Discover: 6011000000000012 with CVV 123
  • JCB: 3088000000000017 with CVV 123
  • Diners Club: 38000000000006 with CVV 123

Any three digit number works for the non-Amex brands in test mode, but 123 is the value most integration guides use, which makes it the easiest to spot in a log file.

Why the sandbox accepts almost any CVV

Card code verification is a live check between the processor and the issuing bank. In test mode there is no bank in the loop, so Authorize.Net returns a result based on your account configuration rather than on the digits you submitted. That is why a developer can run hundreds of test transactions with a card code of 123 and never see a mismatch.

How to trigger a CVV mismatch

Card code filtering is controlled by a setting in the sandbox Merchant Interface, and the letter response you receive follows that setting. Authorize.Net updates sandbox behavior from time to time, so check the current Testing Guide for the exact card code values that produce each letter response before you hard code an expected outcome into an automated suite.

Steps to run an Authorize.Net test CVV transaction

  1. Sign in to the sandbox Merchant Interface and copy your API Login ID and Transaction Key.
  2. Point your integration at the sandbox endpoint, never the production endpoint.
  3. Send a published test card number with cardCode 123, or 1234 for American Express.
  4. Read the response code: 1 for approved, 2 for declined, 3 for error, 4 for held for review.
  5. Check the card code result field to confirm how the gateway recorded the CVV.

Common mistakes

  • Using live API credentials against the sandbox endpoint, which returns authentication errors.
  • Testing with a real card number. Test data belongs in the sandbox, and real card data does not belong in your test logs.
  • Assuming a CVV that approves in the sandbox will approve in production. A live account validates the code against the issuer.
  • Watching only the card code result and ignoring AVS output, since both checks run on the same transaction.
  • Reusing an expired test expiration date and blaming the CVV when the transaction declines.

Legal and security notes

Sandbox values exist for software testing only. Buying, selling, or using a real card number or CVV that belongs to someone else is a federal crime in the United States under 18 U.S.C. § 1029, and card networks treat that activity as fraud. PCI DSS also prohibits storing CVV data after authorization, which is another reason to keep test records free of real card details.

FAQ

Is 123 always the Authorize.Net test CVV?

For sandbox work, 123 is the usual placeholder for Visa, Mastercard, Discover, JCB and Diners Club, while 1234 fits American Express. It is a convention, not a rule the gateway enforces.

Does the CVV decide whether a test transaction approves?

In the sandbox an approval depends mainly on the card number, the expiration date and your account settings. The card code is recorded and returned, but on its own it rarely blocks a test transaction.