Short answer
A CVV test API validates the card verification value field on test card numbers inside a payment provider's sandbox. Those values are fixed and public. Stripe test card 4242 4242 4242 4242 accepts any 3 digit CVC. No test API verifies a real card's CVV. Only an authorization request to the issuer does that.
CVV Test API Compared to Online CVV Selling
What the CVV field holds
Visa, Mastercard and Discover cards use 3 digits. American Express uses 4 digits and labels the field CID. The value sits on the card face. It does not appear in the magnetic stripe or the chip. A merchant sends it with an authorization request and must not keep it afterward.
Where test values come from
Each payment processor publishes its own test card set. A test card number pairs with a CVC rule for that sandbox.
- Stripe documents 4242 4242 4242 4242 with any 3 digits and any future expiry date.
- Stripe lists separate test numbers that return the decline code incorrect_cvc.
- Braintree and Adyen publish test CVC values that trigger named processor decline responses.
Test numbers pass the Luhn check and route to no real account. They work only when the API key belongs to a sandbox or test mode account.
What a test API returns
A typical response carries a status, a decline code and a token. The token replaces the card number for later charges. Sandbox rules decide the result. A CVV of 123 on a success test card returns an approval. A card listed for a CVC failure returns incorrect_cvc even when the digits are valid.
What it cannot do
A test API cannot check a live card. Live CVV verification runs at the issuer during an authorization. There is no public endpoint that validates a live CVV on its own. A service that claims to do this is either sending a real authorization or guessing from the number.
Compliance limits
PCI DSS Requirement 3.2 bars storage of sensitive authentication data after authorization. The CVV is part of that data. Sandbox testing with synthetic numbers keeps cardholder data out of scope. Loading live numbers into a test system puts them in scope and breaks the rule.