For a Braintree card test, reach for the sandbox numbers Braintree publishes in its developer documentation. In the sandbox, 4111111111111111 (Visa), 5555555555554444 (Mastercard), and 378282246310005 (American Express) all produce an approved authorization when paired with any future expiration date and any three digit CVV, or four digits for Amex. These values are inert outside the sandbox. The sections below cover number selection, how to trigger declines and address checks, and how to keep test data separated from live card data.
Braintree Test Card: Sandbox Testing Guide
The core sandbox test numbers
Braintree documents one working test number per major brand plus alternate values used for specific response codes. The common ones:
- Visa: 4111111111111111, with 4012888888881881 as a documented alternate
- Mastercard: 5555555555554444
- American Express: 378282246310005
- Discover: 6011111111111117
- JCB: 3530111333300000
Set the expiration to any future date, such as 12/2030. The CVV field accepts any 3 digits, or 4 for Amex, for a passing result. Keep these values in a fixture file rather than scattered through your test suite, so a documentation update becomes a one line change.
Triggering declines, CVV, AVS, and 3D Secure responses
Approvals are the easy part. Most integration bugs surface in the failure paths, and Braintree publishes test values for those too. Specific card numbers produce processor declines, specific CVV values return each CVV response code (match, no match, not verified, not present), and specific street address and postal code values map to each AVS response code. The 3D Secure section of the docs lists test values for both a passed and a failed authentication.
Braintree also documents test amounts that map to particular decline reasons. Check the current list in the developer docs before hardcoding an amount, because that mapping is a documentation detail that changes over time.
Two ways to run the test
Option 1: Dashboard and API sandbox
- Pros: mirrors production behavior, including gateway responses and webhooks
- Cons: slower feedback, requires sandbox credentials and a server round trip
Option 2: Automated suite against sandbox credentials
- Pros: repeatable, catches regressions, runs on every commit
- Cons: needs network stubbing or a sandbox account in CI, and payment nonces expire
Use the dashboard for exploration and the automated suite for anything you ship. A tokenization nonce generated in the sandbox is not valid in production, so regenerate nonces in each environment.
Mistakes worth avoiding
- Entering a real card number in the sandbox. It will not authorize, and the practice places live account data in a system outside your production controls.
- Assuming sandbox behavior matches live behavior for every decline code. Some issuer responses appear only in production.
- Storing the CVV anywhere. PCI DSS prohibits retaining sensitive authentication data after authorization, including in logs and test fixtures.
Recommendation
If you are validating a checkout flow, start with 4111111111111111 in the sandbox, then work through one decline value, one CVV mismatch, and one AVS mismatch before you touch production keys. That sequence covers the paths that generate real support tickets.