At what point do you need to save data when working with several services through redirects?

Question

Software design

Task: save the debit card in our application (you need to somehow distinguish it from other cards).
Scheme of work:
1. Go to the bank's website and enter the card details
2. The bank redirects to our BE, where we can save the token (we take it from the get-parameter)
3. Next, we send the user to where he came from (to the application)

At what point can I create a record in my DB?
And at what point can the user name the saved map? I'm not sure about this approach and would like to ask for advice on how to solve such problems... There is a problem that the user can spawn cards without receiving a token, since we create an entry in our database in advance.

My idea is to build a jumper between steps 1 and 2, redirecting the user not immediately to the bank, but through my BE, where I could create a card in the database and save the name that he would enter before clicking.


If you put a limit on 5 cards and the flag (is_active) - there may be unattached cards in the database.

If you let him come up with a name for the card after step 3, then he may forget or not want to. And I, in turn, will not be able to tell him what kind of card it is, what bank, etc.