Answer first

Authorize.net test credit card numbers are fixed, publicly published values that work only inside the Authorize.net sandbox. The standard Visa test number is 4111111111111111, paired with any future expiration date, any three-digit CVV, and any valid US ZIP code. A live production gateway rejects these numbers, so they are safe for confirming that your payment form, API call, and response handling work before you switch to real traffic.

What the test numbers cover

Each test card maps to a card brand and, in some cases, a specific outcome. The Visa number 4111111111111111 returns an approval. The number 4222222222222 returns a decline, which lets you test your error path. MasterCard 5424000000000015, American Express 370000000000002, Discover 6011000000000012, and JCB 3088000000000017 cover the remaining brands. These values are public, so they never expose a real account.

Prerequisites

  • A free Authorize.net sandbox account, separate from your production account.
  • The sandbox API Login ID and Transaction Key, not the live credentials.
  • A test page or API client pointed at the sandbox endpoint.

Step-by-step sandbox test

  1. Sign in to the sandbox Merchant Interface at sandbox.authorize.net.
  2. Open Account, then API Credentials & Keys, and generate a sandbox API Login ID and Transaction Key.
  3. Paste those sandbox credentials into your test configuration file and confirm the endpoint points to the sandbox host.
  4. Enter 4111111111111111 in the card number field.
  5. Set the expiration date to any month and year in the future.
  6. Enter 123 in the CVV field and 12345 in the ZIP field.
  7. Submit the transaction and confirm the response contains reason code 1, which means approved.
  8. Repeat the request with 4222222222222 and confirm your form shows a decline message for reason code 2.
  9. Repeat once more with card 4111111111111111 and a mismatched ZIP such as 99999 to trigger an address verification result, then confirm your code handles reason code 27.

Reading the response

A response object carries a result code, a reason code, and a reason text. Code 1 means approved, 2 means declined, and 27 means the address verification check failed. Log all three fields during testing. Your checkout should show the customer a short message and keep the full reason text in server logs for debugging.

Common mistakes

  • Using production credentials against the sandbox host, which returns an authentication error.
  • Entering a real customer card in the sandbox. Processors flag these values, and the PCI standard forbids placing production card data in test systems.
  • Testing only approvals. Decline and address verification paths break silently when they are never exercised.
  • Forgetting that sandbox transactions never settle, so a successful test does not prove your settlement or refund logic.