Should the tokenCallbackUrl and the CardDataCallbackUrl be two separate endpoints?

TokenCallbackUrl and CardDataCallbackUrl can be the same endpoint ifthat suits your need the best. And if you want it to be the same endpoint, but still able to use different deserialization, you can put a parameter in the URI like this: