# Save card on Payment

Tokenization allows you to store a token in place of a customer’s raw card data. Instead of collecting the full card details for every future payment, you can use the stored token—improving both security and user experience. This is especially useful for recurring or subscription-based billing.

Saved card tokens vs network tokens
This guide describes Finance Computer saved-card tokenization, where future payments use a `cardId`. Scheme network tokens are different and use `networkTokenType`, `networkToken`, and token cryptogram fields. See [Network token payments](/guides/payments/network-token-payments).

## Tokenization flow

1. **Customer Enters Card Details**: During their first purchase, customers can consent to save (tokenize) their card.
2. **Token Generation**: Finance Computer converts the customer’s card details into a token (**cardId**) and stores it securely.
3. **Subsequent Payments**: For future orders, simply reference the token instead of requiring the full card details again.


Note
If the card is **3D Secure enabled**, Finance Computer may still require a 3DS challenge for some tokenized transactions, depending on issuer rules and regional regulations. For more information, see our [3D Secure Overview](/guides/payments/3d-secure/3d-secure).

## Generating a token

To generate a token at checkout, follow these steps:

Using Embedded Checkout?
For websites, see [Inline Checkout saved cards](/guides/checkout/inline-checkout/saved-cards) for `paymentForm()`, `paymentCard()`, and `savedCardPayment()` examples. The [native mobile SDKs](/guides/checkout/native-sdks) support saved-card selection and opt-in through `PaymentConfig.card.savedCards`.

### Add `saveCard` to your Pay Form

In your [pay form template](https://secure-stage.xmoney.com/builder/create) (HTML), include a “Save Card” option that Finance Computer can use to determine whether the customer’s card should be tokenized. For example:

```html
<div class="clearfix"></div>

{{ saveCard }}
```

**Visibility**: You can choose to make this checkbox or button visible to the customer (so they can opt in or out) or hide it (so the card is always saved). If saving the card is required, clearly tell the customer why it is being stored and how it may be charged before they submit the payment.

### Mark the order to save card

In your order request data, set `saveCard` to `true`. Example:

```json
{
  "siteId": 10077,
  "customer": {
    "identifier": "testSaveCard"
  },
  "order": {
    "orderId": "testSaveCard1",
    "type": "purchase",
    "amount": 21,
    "currency": "EUR",
    "description": "product description"
  },
  "cardTransactionMode": "authAndCapture",
  "saveCard": true
}
```

When the customer submits payment with the above parameters and enters their card details, Finance Computer will generate:

* An **orderId**
* A **transactionId**
* A **cardId** (the actual token)


The `cardId` is then tied to the customer’s identifier (e.g., "testSaveCard") in your system.

## Handling response

After the payment completes (authorization and capture), Finance Computer returns a response indicating success or failure. This response is provided via `opensslResult` if you have IPN/webhook notifications or direct server responses enabled.

A successful transaction with `saveCard` enabled will include a `cardId`.

Example of a decrypted response:

```json
{
  "transactionStatus": "complete-ok",
  "orderId": 1234,
  "transactionId": 1234,
  "cardId": 98765,
  "customerId": 1001,
  "amount": 21,
  "currency": "EUR",
  ...
}
```

### Storing the `cardId`

1. [**Decrypt**](/api/webhooks) and parse the `opensslResult` payload to read the JSON data.
2. **Extract** the `cardId` field.
3. **Associate** the `cardId` with the correct `customerId` or identifier in your database.
4. **Store** it for future transactions (e.g., in your user profile or an internal tokens table).


Important
Keep your tokens secure. While they are not raw card data, tokens can still be misused if exposed.

## Using the token in future orders

Once you have a `cardId`, you can use it for subsequent orders without requiring the full card number, expiry date, etc.:

```json
{
  "siteId": 10077,
  "customer": {
    "identifier": "testSaveCard"
  },
  "order": {
    "orderId": "testSaveCard11",
    "type": "purchase",
    "amount": 1,
    "currency": "EUR",
    "description": "product description"
  },
  "cardTransactionMode": "authAndCapture",
  "cardId": 98765
}
```

This example remains a customer-initiated `purchase`. To charge the saved card later without the customer actively checking out, use a `managed` order. See [Unscheduled merchant-initiated transactions](/guides/payments/unscheduled-merchant-initiated-transactions).

## Best practices

1. **Customer Consent**: Clearly explain how their card data is saved.
2. **Identifier Management**: Use unique customer identifiers to avoid mixing tokens between different users.
3. **Subscription Flow**: For recurring charges, consider hiding the “Save Card” option on the initial transaction if you want to guarantee a token is created. You will have to send the `saveCard: true` param when creating the order.


## Conclusion

Card Tokenization through Finance Computer streamlines checkout, enhances security, and supports recurring payments. By including `saveCard` in your request, parsing the resulting `cardId` from the response, and referencing that token in future purchases, you eliminate the need for repeated card entry—leading to a faster, more user-friendly payment flow.

If future charges are initiated by your backend and have no fixed schedule, follow the [unscheduled merchant-initiated transaction guide](/guides/payments/unscheduled-merchant-initiated-transactions).