# Store a card (Direct API)

> This guide instructs you on how to integrate independent card binding through server-to-server mode, allowing buyers to bind their bank cards at any stage of the payment process.

This guide instructs you on how to integrate independent card binding through server-to-server mode, allowing buyers to bind their bank cards at any stage of the payment process. In this solution, you can collect the buyer's plain card information and submit the information to Antom for storage. Once the binding is successful, Antom will return the corresponding card token (_cardToken_). In subsequent transactions, you can directly use the _cardToken_ parameter to initiate payments without collecting the buyer's card information again. For token (_cardToken_) payments, please refer to [Card-on-File (COF) transactions](https://docs.antom.com/ac/pm/cof.md).

Server-to-server integration mode requires that you are PCI qualified. Please provide the relevant materials based on your business needs to complete the verification:

-   If your annual card transaction volume is expected to exceed 6 million, complete and submit the [PCI Attestation of Compliance (AoC)](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Reporting%20Template%20or%20Form/PCI-DSS-v4-0-ROC-AOC-Merchants-r1.pdf) file for verification.
-   If your annual card transaction volume is expected to be below 6 million, complete and submit the [PCI DSS Self-Assessment Questionnaires (SAQs)](https://docs-prv.pcisecuritystandards.org/SAQ%20(Assessment)/SAQ/PCI-DSS-v4-0-SAQ-D-Merchant-r1.pdf) file for verification.

For more information about PCI DSS compliance requirements, see [PCI DSS standard](https://www.pcisecuritystandards.org/).

## User experience

The following images show the user experience during the card binding process and the subsequent payments after successful binding.

### Binding process

The following diagram illustrates the card binding process across different platforms.

#### Tab: Web

![Card binding web user experience of API integration.png](https://idocs-assets.marmot-cloud.com/storage/idocs87c36dc8dac653c1/yuque/idocs/2026/png/393da64d-e1c0-436f-9005-d57ee602d151.png)

#### Tab: Mobile

![Card binding mobile user experience of API integration.png](https://idocs-assets.marmot-cloud.com/storage/idocs87c36dc8dac653c1/yuque/idocs/2026/png/ba6ba9d8-c664-4942-91f3-75ebd5a6560e.png)

### Subsequent payments

The following diagram illustrates the user experience of subsequent payments on different platforms after successful card binding.

#### Tab: Web

![Web user experience of subsequent payments.png](https://idocs-assets.marmot-cloud.com/storage/idocs87c36dc8dac653c1/yuque/idocs/2025/png/bb0e340a-6085-4ec9-b66e-208838f06658.png)

#### Tab: Mobile

![Mobile user experience of subsequent payments.png](https://idocs-assets.marmot-cloud.com/storage/idocs87c36dc8dac653c1/yuque/idocs/2025/png/76f6825f-5c40-4fbe-a04e-f67074909b41.png)

## Binding flow

The following steps describe the card binding process in a server-to-server integration mode:

![Card binding flow using API integration.png](https://idocs-assets.marmot-cloud.com/storage/idocs87c36dc8dac653c1/yuque/idocs/2026/png/b0190cb8-4c63-42fd-8745-a95f660972f6.png)

1.  **The buyer clicks to bind a card.**
2.  **Call the** [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) **API and initiate a card** **binding** **request.**
    After the buyer clicks the card binding button, your server calls the Antom server's [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API to initiate the card binding request.
3.  **The buyer completes card binding.
    **The buyer completes card binding on the merchant page.
4.  **(Optional) The buyer completes 3D authentication.**
    If 3D authentication is specified, Antom returns a 3D URL to the client. You need to redirect the buyer to the 3D authentication page (_normalUrl_), and guide them to complete the 3D authentication.
5.  **Obtain the card** **binding** **result.**
    You can obtain the card vaulting result through either of the following two methods:

-   Asynchronous notification: Antom will send you the card binding result notifications via the [**notifyVaulting**](https://docs.antom.com/ac/ams/notify_vaulting.md) API.
-   Synchronous inquiry: Call the **[inquireVaulting](https://docs.antom.com/ac/ams/inquire_vaulting.md)** API to check the binding status.

> **Note**: On the card binding management page, you must present the masked card number of the buyer’s stored card. For subsequent payments, it is recommended to pass in _cardToken_ obtained from the initial binding through the [**notifyVaulting**](https://docs.antom.com/ac/ams/notify_vaulting.md) or [**inquireVaulting**](https://docs.antom.com/ac/ams/inquire_vaulting.md) API, or you can use the stored plain card number.

## Integration preparations

Before you start integrating, read the [Integration Guide](https://docs.antom.com/integration_guide_en.md) and [API Overview](https://docs.antom.com/ac/ams/api_fund.md) documents to understand the integration steps of the server-side API and the precautions for calling the API. Furthermore, ensure that the following prerequisites are met:

-   Obtain a client ID
-   Complete the key configuration
-   Complete the configuration of _paymentNotifyUrl_ to receive the asynchronous notification
-   Integrate the server-side SDK package, install the server-side library, and initialize a request instance. For more details, refer to [Server-side SDKs](https://docs.antom.com/ac/sdks/server_sdks.md).

## Integration steps

Most bank card payments follow the general payment flow and integration process provided by Antom. Follow the steps below to begin your integration:

1.  Initiate a card vaulting request
2.  (Optional) Redirect to 3D authentication page (_normalUrl_)
3.  Obtain the vaulting result

### Step 1: Initiate a card binding request Server-side

Call the [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API and pass the following key parameters to initiate a card binding request:

| **Parameter name** | **Required** | **Description** |
| --- | --- | --- |
| _paymentMethodDetail.card_ | Yes | Pass in the card information that needs to be bound. |
| _vaultingRequestId_ | Yes | The unique ID generated by the merchant. Every time you initiate card binding, you must have a new ID. |
| _paymentMethodDetail.paymentMethodType_ | Yes | The field is fixed to `CARD`. |
| _paymentMethodDetail.card.is3DSAuthentication_ | No | Specify whether 3D authentication is required for this card binding request. Set the value to `true` if 3D authentication is required. > **Notes**: > > - [South Korean Cards](https://docs.antom.com/ac/antomop/south_korean_mdx.md) do not support 3D authentication. > - If subsequent payments involve [Merchant-Initiated Transaction (MIT)](https://docs.antom.com/ac/pm/mit.md) scenarios, the card scheme strongly recommends specifying 3D authentication when binding the card. |
| _redirectUrl_ | Yes | The merchant side binds the results page, which needs to be displayed based on the server side results. |
| _vaultingNotificationUrl_ | Yes | The card binding result notification address. |
| _env_ | Yes | The environment in which the buyer initiates a card binding request. |

For more information about complete parameters, refer to the [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API.

You need to call the [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API to initiate the card binding request.The following sample code shows how to call the [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API:

```java
public static void  vaultPaymentMethod(){
    AlipayVaultingPaymentMethodRequest alipayVaultingPaymentMethodRequest = new AlipayVaultingPaymentMethodRequest();

    // set card info
    CardPaymentMethodDetail cardPaymentMethodDetail = CardPaymentMethodDetail.builder().cardNo("4054695723100768").expiryMonth("01").expiryYear("2030").build();
    PaymentMethodDetail paymentMethodDetail = PaymentMethodDetail.builder().paymentMethodType("CARD").card(cardPaymentMethodDetail).build();
    alipayVaultingPaymentMethodRequest.setPaymentMethodDetail(paymentMethodDetail);

    // set env
    Env env = Env.builder().terminalType(TerminalType.WEB).build();
    alipayVaultingPaymentMethodRequest.setEnv(env);

    // replace with your vaultingRequestId
    String vaultingRequestId = UUID.randomUUID().toString();
    alipayVaultingPaymentMethodRequest.setVaultingRequestId(vaultingRequestId);

    // replace with your notificationUrl
    alipayVaultingPaymentMethodRequest.setVaultingNotificationUrl("https://www.yourNotifyUrl.com");

    // replace with your redirectUrl
    alipayVaultingPaymentMethodRequest.setRedirectUrl("https://www.yourMerchantWeb.com");

    // do vaulting
    AlipayVaultingPaymentMethodResponse alipayVaultingPaymentMethodResponse;

    try{
        alipayVaultingPaymentMethodResponse = CLIENT.execute(alipayVaultingPaymentMethodRequest);
    }catch (AlipayApiException e){
        String errorMsg = e.getMessage();
    }
}
```

The following sample codes show the examples of initiating a card binding request message, and you can also specify whether 3D authentication is required:

#### Tab: Non-3D authentication

```json
{
  "vaultingRequestId": "VAULT_20250508183612361_AUTO",
  "vaultingNotificationUrl": "https://kademo.intlalipay.cn/payments/notifySuccess",
  "redirectUrl": "https://kademo.intlalipay.cn/melitigo/Test_114.html",
  "paymentMethodDetail": {
    "paymentMethodType": "CARD",
    "card": {
      "cvv": "**5",
      "cardholderName": {
        "firstName": "liang",
        "lastName": "x*****n"
      },
      "expiryMonth": "**",
      "expiryYear": "**",
      "payerEmail": "2421********com",
      "cardNo": "537********1310"
    }
  },
  "env": {
    "terminalType": "APP",
    "osType":"IOS",
    "clientIp":"12.99.168.1"
  }
}
```

#### Tab: 3D authentication

```json
{
  "vaultingRequestId": "VAULT_20250508183612361_AUTO",
  "vaultingNotificationUrl": "https://kademo.intlalipay.cn/payments/notifySuccess",
  "redirectUrl": "https://kademo.intlalipay.cn/melitigo/Test_114.html",
  "paymentMethodDetail": {
    "paymentMethodType": "CARD",
    "card": {
      "cvv": "**5",
      "cardholderName": {
        "firstName": "liang",
        "lastName": "x*****n"
      },
      "expiryMonth": "**",
      "expiryYear": "**",
      "payerEmail": "2421********com",
      "cardNo": "537********1310",
      "is3DSAuthentication":true
    }
  },
  "env": {
    "terminalType": "APP",
    "osType":"IOS",
    "clientIp":"12.99.168.1"
  }
}
```

The following codes show samples of the response:

#### Tab: The binding is successful

```json
{
  "paymentMethodDetail": {
    "card": {
      "brand": "MASTERCARD",
      "cardToken": "ALIPAYEfG2DFbGx2Eh****************************XA7nyWCloE4MwfmN48sP1+rSPQ==",
      "maskedCardNo": "************1310"
    },
    "paymentMethodType": "CARD"
  },
  "vaultingRequestId": "VAULT_20250508183612361_AUTO",
  "result": {
    "resultCode": "SUCCESS",
    "resultMessage": "success.",
    "resultStatus": "S"
  }
}
```

#### Tab: The binding failed

```json
{
  "result": {
    "resultCode": "INVALID_CVV",
    "resultMessage": "INVALID_CVV",
    "resultStatus": "F"
  }
}
```

#### Tab: Returned 3D URL

```json
{
    "normalUrl": "https://authentication-devices.checkout.com/sessions-interceptor/sid_gzj3mn4qd5bupemnyt4fxb5cse",
    "redirectActionForm": {
        "method": "POST",
        "redirectUrl": "https://authentication-devices.checkout.com/sessions-interceptor/sid_gzj3mn4qd5bupemnyt4fxb5cse"
    },
    "vaultingRequestId": "VAULT_20250512164703243_AUTO",
    "result": {
        "resultCode": "VERIFICATION_IN_PROCESS",
        "resultMessage": "The verification is still under process.",
        "resultStatus": "U"
    }
}
```

The table below shows the possible values of _result.resultStatus_ in the response. Please handle the result according to the guidance provided:

| **_result.resultStatus_** | **Message** | **Further action** |
| --- | --- | --- |
| `S` | Indicates that the card binding is successful. | It is recommended to store the following parameters for subsequent payments: - _cardToken_: A token generated by Antom for subsequent payments. You can associate this information with your buyer for subsequent payments. - _brand_: The card brand. It is recommended that you store this information to display to the buyer in subsequent payments. - _maskedCardNo_: The masked card number. It is recommended that you store this information to display to the buyer in subsequent payments. |
| `F` | Indicates that the card binding failed. | Check and verify whether the required request fields (including the header fields and body fields) of the current API are correctly passed and valid. |
| `U` | Indicates that the card binding is being processed. | Perform operations based on whether the value of _result.resultCode_ is `VERIFICATION_IN_PROCESS`: - If _result.resultCode_ is not `VERIFICATION_IN_PROCESS`: Indicates that the API call failed. Please call this API again with a new _vaultingRequestId._ - If _result.resultCode_ is `VERIFICATION_IN_PROCESS`: Check whether the _normalUrl_ is returned. - If the _normalUrl_ is returned: The card binding is successfully created. Redirect the buyer to the specified link to complete the binding process. - If the _normalUrl_ is not returned: The card binding creation failed. Please call this API again with a new _vaultingRequestId_. If the issue persists, contact Antom technical support. |

> **Note**: If no response is received, it may indicate a network timeout. Please use the same _vaultingRequestId_ to call the API again.

### (Optional) Step 2: Redirect to 3D authentication page (_normalUrl_)

After the merchant server obtains _normalUrl_ from Antom and passes it to the frontend, it will redirect from the merchant frontend to the 3D authentication page. After card binding is completed, the system will redirect back to the _redirectUrl_ you provided in the binding request. You need to display the binding result based on the response returned by Antom.

#### Tab: Web

After obtaining the _normalUrl_, you need to redirect the page to the 3D authentication page in a browser or open it in a new tab.

```javascript
if (serverResponse.normalUrl != null) {
  window.open(serverResponse.normalUrl, '_blank');
}
```

#### Tab: WAP

After obtaining the _normalUrl_, you need to redirect the page to the 3D authentication page in a browser or open it in a new tab.

```javascript
window.location.href = URL;
```

#### Tab: iOS

After obtaining _normalUrl_, you need to redirect the buyer from your merchant application to the system's default browser to load the 3D authenticatiob page. The buyer submits payments on this page.

```objectivec
// Initialize webView configuration
WKWebViewConfiguration *configuration = [[WKWebViewConfiguration alloc]init];
// Initialize webView
WKWebView *webView = [[WKWebView alloc]initWithFrame:CGRectMake(0, 0, [UIScreen mainScreen].bounds.size.width, [UIScreen mainScreen].bounds.size.height) configuration:configuration];
webView.navigationDelegate = self;
// Load payment method URL
[webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:Url]]];
[self.view addSubview:self.webView];
```

#### Tab: Android

After obtaining _normalUrl_, you need to redirect the buyer from your merchant application to the system's default browser to load the 3D authenticatiob page. The buyer submits payments on this page.

```java
WebView webView = findViewById(R.id.webview);
//Set webview
webView.setWebViewClient(new WebViewClient() {
    @Override
    public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request) {
        view.loadUrl(request.getUrl().toString());
        return super.shouldOverrideUrlLoading(view, request);
    }});

WebSettings webSettings = webView.getSettings();
//Enable javascript
webSettings.setJavaScriptEnabled(true);
//Enable scaling
webSettings.setSupportZoom(true);
//Enable scaling controls (buttons)
webSettings.setBuiltInZoomControls(true);
//Webview has two cache modes. Cache is not used here.
webSettings.setCacheMode(WebSettings.LOAD_NO_CACHE);
//Allow JavaScript to open a new tab (false by default)
webSettings.setJavaScriptCanOpenWindowsAutomatically(true);
//Allow JavaScript to load local storage
webSettings.setDomStorageEnabled(true);
//WAP cache size (settings are not needed)
//webSettings.setAppCacheMaxSize(1024 * 1024 * 8);
//WAP cache path
String absolutePath = getApplicationContext().getCacheDir().getAbsolutePath();
//WAP cache size
webSettings.setAppCachePath(absolutePath);
//Set whether to allow WebView to access files (true by default)
webSettings.setAllowFileAccess(true);
//Allow WAP cache to be saved
webSettings.setAppCacheEnabled(true);
//In preview mode, if the page width exceeds the WebView display, scale down the page to fit WebView (false by default)
webSettings.setLoadWithOverviewMode(true);
//Support the viewport HTML meta tag
webSettings.setUseWideViewPort(true);
//Load the payment method URL
webView.loadUrl(Url);
```

> **Common question**
>
> **Q:** **Is 3D Secure supported?**
>
> A: Yes. For details, refer to [3D Secure 2](https://docs.antom.com/ac/pm/3ds.md).

### Step 3: Obtain the card binding result Server-side

You can obtain the card binding result through either of the following two methods:

-   Receive asynchronous notifications: Antom will send you the card binding result notifications via the [**notifyVaulting**](https://docs.antom.com/ac/ams/notify_vaulting.md) API.
-   Inquire about the binding result: Call the **[inquireVaulting](https://docs.antom.com/ac/ams/inquire_vaulting.md)** API to check the binding status.

#### Tab: Asynchronous notification

#### Asynchronous notification

##### 1\. **Configure the webhook URL to receive asynchronous notifications**

If each of your binding operations has a unique notification URL, it is recommended to set the webhook URL in each request. You can pass the asynchronous notification receiving URL for the specific order through _vaultingNotificationUrl_ in the [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API.

The following code shows a sample of the asynchronous notification request:

```json
{
    "paymentMethodDetail": {
        "card": {
            "brand": "MASTERCARD",
            "cardToken": "ALIPAY34RlcCU3ZtZ***********************sVYl8x244tyWCloE4MwfmN48sP1+rSPQ==",
            "maskedCardNo": "************1310",
            "networkTransactionId": "112000********575887"
        },
        "paymentMethodType": "CARD"
    },
    "vaultingRequestId": "VAULT_20250*****3348834_AUTO",
    "result": {
        "resultCode": "SUCCESS",
        "resultMessage": "success.",
        "resultStatus": "S"
    }
}
```

The following table shows the possible values of _result.resultStatus_ in the notification request of authorization result. Please handle the result according to the guidance provided:

| **_result.resultStatus_** | **Message** | **Further actions** |
| --- | --- | --- |
| `S` | Indicates that the card vaulting is successful. | It is recommended to store the following parameters for subsequent payments: - _cardToken_: A token generated by Antom for subsequent payments. You can associate this information with your buyer for subsequent payments. - _brand_: The card brand. It is recommended that you store this information to display to the buyer in subsequent payments. - _maskedCardNo_: The masked card number. It is recommended that you store this information to display to the buyer in subsequent payments. |
| `F` | Indicates that the card vaulting failed. | Please check _result.resultCode_ to identify the specific failure reason. |

##### 2\. **Verify the asynchronous notification**

When you receive an asynchronous notification from Antom, you are required to return the response in the [Sample code](https://docs.antom.com/ac/cashierpay/notifications.md#vQK5A) format, but you do not need to countersign the response.

You need to verify the signature of the authorization payment notification sent by Antom:

```java
import javax.servlet.http.HttpServletRequest;

import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

import com.alipay.global.api.model.Result;
import com.alipay.global.api.model.ResultStatusType;
import com.alipay.global.api.response.AlipayResponse;
import com.alipay.global.api.tools.WebhookTool;

@RestController
public class PaymentNotifyHandleBySDK {

    /**
     * alipay public key, used to verify signature
     */
    private static final String SERVER_PUBLIC_KEY = "";

    /**
     * payment result notify processor
     * using <a href="https://spring.io">Spring Framework</a>
     *
     * @param request    HttpServletRequest
     * @param notifyBody notify body
     * @return
     */
    @PostMapping("/payNotify")
    public Object payNotifyHandler(HttpServletRequest request, @RequestBody String notifyBody) {

        // retrieve the required parameters from http request.
        String requestUri = request.getRequestURI();
        String requestMethod = request.getMethod();

        // retrieve the required parameters from request header.
        String requestTime = request.getHeader("request-time");
        String clientId = request.getHeader("client-id");
        String signature = request.getHeader("signature");

        Result result;
        AlipayResponse response = new AlipayResponse();

        try {
            // verify the signature of notification
            boolean verifyResult = WebhookTool.checkSignature(requestUri, requestMethod, clientId, requestTime, signature, notifyBody, SERVER_PUBLIC_KEY);
            if (!verifyResult) {
                throw new RuntimeException("Invalid notify signature");
            }

            // deserialize the notification body

            // update the order status with notify result

            // respond the server that the notification is received
            result = new Result("SUCCESS", "success", ResultStatusType.S);

        } catch (Exception e) {
            String errorMsg = e.getMessage();
            // handle error condition
            result = new Result("ERROR", errorMsg, ResultStatusType.F);
        }
        response.setResult(result);
        return ResponseEntity.ok().body(response);
    }

}
```

Whether the vaulting is successful or not, each notification request must be responded to in the format specified below. Otherwise, Antom will resend the asynchronous notification.

```json
{
    "result": {
        "resultCode": "SUCCESS",
        "resultStatus": "S",
        "resultMessage": "success"
    }
}
```

#### Tab: Inquire about the binding result

#### Inquire about the binding result

In addition to obtaining card binding results through asynchronous notifications, you can also query to get the results. You can inquire about the binding result by calling the [**inquireVaulting**](https://docs.antom.com/ac/ams/inquire_vaulting.md) API using _vaultingRequestId_ from the card binding request.

The following sample code shows how to call the [**inquireVaulting**](https://docs.antom.com/ac/ams/inquire_vaulting.md) API:

```java
public static void inquireVaulting(){
    AlipayVaultingQueryRequest alipayVaultingQueryRequest = new AlipayVaultingQueryRequest();

    //replace with your vaultingRequestId
    alipayVaultingQueryRequest.setVaultingRequestId("c7f3ee64-c472-4d12-b8de-3157804ed55f");

    AlipayVaultingQueryResponse alipayVaultingQueryResponse;
    try{
        alipayVaultingQueryResponse = CLIENT.execute(alipayVaultingQueryRequest);
    }catch (AlipayApiException e){
        String errorMsg = e.getMessage();
        // handle error condition
    }
}
```

The following sample code shows a request message:

```json
{
   "vaultingRequestId": "VAULT_20250508183612361_AUTO"
}
```

The following sample code shows a response message:

```json
{
    "paymentMethodDetail": {
        "card": {
            "brand": "MASTERCARD",
            "cardToken": "ALIPAYEfG2DFbGx2Eh****************************XA7nyWCloE4MwfmN48sP1+rSPQ==",
            "maskedCardNo": "************1310",
             "networkTransactionId": "112000********575887"
        },
        "paymentMethodType": "CARD"
    },
    "result": {
        "resultCode": "SUCCESS",
        "resultMessage": "success.",
        "resultStatus": "S"
    },
    "vaultingRequestId": "VAULT_2025*******2361_AUTO",
    "vaultingStatus": "SUCCESS"
}
```

The table below shows the possible values of _result.resultStatus_ in the response. Please handle the result according to the guidance provided:

| _**result.resultStatus**_ | **Message** | **Further actions** |
| --- | --- | --- |
| `S` | Indicates that the [**inquireVaulting**](https://docs.antom.com/ac/ams/inquire_vaulting.md) API is called successfully. | You can obtain the card binding result from the _vaultingStatus_ field in the API response. |
| `F` | Indicates that the [**inquireVaulting**](https://docs.antom.com/ac/ams/inquire_vaulting.md) API call failed. | For more information about the failure reason, refer to _result.resultCode._ |
| `U` | Indicates that the [**inquireVaulting**](https://docs.antom.com/ac/ams/inquire_vaulting.md) API call failed for unknown reasons. | Use the same _vaultingRequestId_ to try again. |

> **Common questions**
>
> **Q: Will an asynchronous notification be sent immediately after a successful card** **binding****?**
>
> A: The asynchronous notification for the card binding result is sent within seconds, typically 3 to 5 seconds after the card binding succeeds.
>
> **Q:** **Will an asynchronous notification be sent if the card** **binding** **fails?**
>
> A: Yes, it will be sent.
>
> **Q: Will the asynchronous notification be re-sent?**
>
> A: Yes, the asynchronous notification will be re-sent automatically within 24 hours for the following cases:
>
> -   If you didn't receive the asynchronous notification due to network reasons.
> -   If you receive an asynchronous notification from Antom, but you did not respond to the notification in the [Sample code](https://docs.antom.com/ac/cashierpay/notifications.md#vQK5A) format.
>
> The notification can be resent up to 8 times or until a correct response is received to terminate delivery. The sending intervals are as follows: 0 minutes, 2 minutes, 10 minutes, 10 minutes, 1 hour, 2 hours, 6 hours, and 15 hours.
>
> **Q:** **Do I need to verify the signature upon receiving a** **binding** **result notification?**
>
> A: Yes. Signature verification is necessary to ensure that the request was sent to you by Antom. When performing verification, the assembled message must strictly adhere to the following format: `<http-method> <http-uri> <client-id>.<request-time>.<request-body>`. For the `<request-body>` part, you must use its original, unprocessed string value.
>
> **Q:** **How long is the validity period of the returned** _**cardToken**_**?**
>
> A: The _cardToken_ itself is permanently valid. If the card expires, it will become invalid at the same time. If the card expires, when you call the payment request again, Antom will return the `INVALID_EXPIRATION_DATE` error code. It is recommended that you guide the buyer to re-bind the updated card information.
>
> **Q: Do I have to use the** _**cardToken**_ **returned by Antom for subsequent payments?**
>
> A: If you store the plaint card number yourself after completing card binding, you may use the plaint card number for subsequent payments. However, it is strongly recommended that you use Antom's _cardToken_ to initiate subsequent transactions, as data shows that the success rate of subsequent [Card-on-File (COF) transactions](https://docs.antom.com/ac/pm/cof.md) initiated using Antom's _cardToken_ is significantly higher than using the method of storing card information by yourself.
>
> **Q: Do all 3DS transactions return a** _**normalUrl**_ **that is used to redirect to the 3DS authentication page?**
>
> A: No. In certain scenarios, the issuer returns the 3DS frictionless result synchronously, and Antom will directly return the authorization result (_resultStatus_) and 3DS result (_threeDSResult_) in the [**vaultPaymentMethod**](https://docs.antom.com/ac/ams/vault_method.md) API's synchronous response.