Choose from any of our gift cards to give to your loved ones
CVV Test Environment Systems: How Sandbox Card Verification Actually Works
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
CVV test environment software is a sandbox that simulates card verification value (CVV) checks so developers can test payment flows without touching real card data. It returns the same response codes a live processor returns, including CVV match, mismatch, and not processed results. Real card numbers, real CVVs, and real cardholder data never enter the sandbox.
Teams use it to confirm that a checkout page, subscription engine, or fraud rule reacts the right way when a CVV check passes or fails. The software sits between your application and a mock processor, so no money moves and no issuer gets contacted.
Every test environment does three things: it accepts a card-like payload, decides what the CVV result should be, and returns a response your code can parse.
Payment providers issue test API keys that work against sandbox endpoints, often on a separate hostname from live traffic. Those keys carry no value outside the sandbox and cannot charge a live card.
Processors reply with single-letter CVV codes taken from card network specs. A simulator lets you force each one:
Your code needs a path for each result. A checkout that blocks only on N will still ship orders when the issuer returns U.
Good simulation covers more than the happy path. A tool that only approves transactions will not test your failure handling.
Most major processors ship one at no cost. The list below covers the ones teams meet most:
Gateways publish their own test card numbers and CVV rules, so check current docs before you hardcode anything. Numbers change, and stale test cards break CI builds.
Each processor publishes its own list. Stripe documents 4242 4242 4242 4242 for Visa approvals, and other gateways publish similar ranges. Those numbers come from public documentation and work only against sandbox endpoints.
The rules are short. Never use a card number you did not get from provider docs or a test BIN generator. Never point a test script at a live endpoint. A test environment that touches real cardholder data stops being a test environment and becomes a compliance incident.
It cannot tell you whether a real card is valid, funded, or open. That question belongs to the issuer, and answering it means running a live authorization against a real account.
Software marketed as a CVV checker that pushes live card numbers through real authorization endpoints is not a test tool. It breaks card network rules, breaks PCI DSS, and is illegal in most jurisdictions. Legitimate test environment software never asks for a real card number.
PCI DSS calls for test and production environments to stay separate, and forbids live account data inside test systems. Auditors check this during assessment.
Practical controls: masked data, synthetic card numbers, tight access limits, and a documented path for promoting code from test to production. Card network rules add their own layer, since using a real account number in a sandbox can count as an unauthorized transaction attempt.
No. Sandboxes accept documented test numbers that trigger each CVV response. Real numbers add risk and no extra coverage.
Yes. Testing your own integration with provider-issued test cards is standard practice. Testing live card numbers against real accounts is not.
PCI DSS forbids storing CVV after authorization in production. Test data should use synthetic values so the question never comes up.
Every deploy, plus any time a provider changes its sandbox. Response behavior shifts when processors update APIs.
