diff --git a/payapi-common/src/main/java/com/supwisdom/dlpay/api/bean/SignBxyParam.java b/payapi-common/src/main/java/com/supwisdom/dlpay/api/bean/SignBxyParam.java
new file mode 100644
index 0000000..43161f2
--- /dev/null
+++ b/payapi-common/src/main/java/com/supwisdom/dlpay/api/bean/SignBxyParam.java
@@ -0,0 +1,39 @@
+package com.supwisdom.dlpay.api.bean;
+
+import com.supwisdom.dlpay.api.APIRequestParam;
+import com.supwisdom.dlpay.api.annotation.Sign;
+import com.supwisdom.dlpay.api.exception.RequestParamCheckException;
+import lombok.Getter;
+import lombok.Setter;
+
+import javax.validation.constraints.NotEmpty;
+
+@Getter
+@Setter
+public class SignBxyParam extends APIRequestParam {
+  @Sign
+  @NotEmpty(message = "用户id不能为空")
+  private String userid;
+  @Sign
+  @NotEmpty(message = "手机用户id不能为空")
+  private String uid;
+  @Sign
+  @NotEmpty(message = "rsaprivate不能为空")
+  private String rsaprivate;
+  @Sign
+  @NotEmpty(message = "secertkey不能为空")
+  private String secertkey;
+  @Sign
+  @NotEmpty(message = "rsapublic不能为空")
+  private String rsapublic;
+  @Sign
+  @NotEmpty(message = "验证码不能为空")
+  private String code;
+  @Sign
+  @NotEmpty(message = "手机号不能为空")
+  private String phone;
+  @Override
+  public boolean checkParam() throws RequestParamCheckException {
+    return true;
+  }
+}
diff --git a/payapi-sdk/src/main/java/com/supwisdom/dlpay/paysdk/proxy/UserProxy.java b/payapi-sdk/src/main/java/com/supwisdom/dlpay/paysdk/proxy/UserProxy.java
index 575d011..ac510c5 100644
--- a/payapi-sdk/src/main/java/com/supwisdom/dlpay/paysdk/proxy/UserProxy.java
+++ b/payapi-sdk/src/main/java/com/supwisdom/dlpay/paysdk/proxy/UserProxy.java
@@ -65,7 +65,7 @@
   Map<String, Object> bindCardCode(@RequestParam("userid") String userid,@RequestParam("phone") String phone);
 
   @PostMapping("/api/user/signbxy")
-  ApiResponse signbxy(@RequestParam("userid") String userid,@RequestParam("code") String code,@RequestParam("phone") String phone);
+  ApiResponse signbxy(@RequestBody SignBxyParam param);
 
   @PostMapping("/api/user/unsignbxy")
   ApiResponse unsignbxy(@RequestParam("userid") String userid,@RequestParam("phone") String phone);
diff --git a/payapi/src/main/java/com/supwisdom/dlpay/api/dao/UserSecretDao.java b/payapi/src/main/java/com/supwisdom/dlpay/api/dao/UserSecretDao.java
new file mode 100644
index 0000000..a31419d
--- /dev/null
+++ b/payapi/src/main/java/com/supwisdom/dlpay/api/dao/UserSecretDao.java
@@ -0,0 +1,7 @@
+package com.supwisdom.dlpay.api.dao;
+
+import com.supwisdom.dlpay.api.domain.TUserSecret;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface UserSecretDao extends JpaRepository<TUserSecret, String> {
+}
diff --git a/payapi/src/main/java/com/supwisdom/dlpay/api/domain/TUserSecret.java b/payapi/src/main/java/com/supwisdom/dlpay/api/domain/TUserSecret.java
new file mode 100644
index 0000000..e5598e9
--- /dev/null
+++ b/payapi/src/main/java/com/supwisdom/dlpay/api/domain/TUserSecret.java
@@ -0,0 +1,66 @@
+package com.supwisdom.dlpay.api.domain;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "tb_user_secret")
+public class TUserSecret {
+  @Id
+  @Column(name = "uid", nullable = false, length = 32)
+  private String uid;
+
+  @Column(name = "userid", length = 32)
+  private String userid;
+
+  @Column(name = "rsaprivate", length = 1000)
+  private String rsaprivate;
+
+  @Column(name = "rsapublic", length = 1000)
+  private String rsapublic;
+
+  @Column(name = "secertkey", length = 64)
+  private String secertkey;
+
+  public String getUid() {
+    return uid;
+  }
+
+  public void setUid(String uid) {
+    this.uid = uid;
+  }
+
+  public String getUserid() {
+    return userid;
+  }
+
+  public void setUserid(String userid) {
+    this.userid = userid;
+  }
+
+  public String getRsaprivate() {
+    return rsaprivate;
+  }
+
+  public void setRsaprivate(String rsaprivate) {
+    this.rsaprivate = rsaprivate;
+  }
+
+  public String getRsapublic() {
+    return rsapublic;
+  }
+
+  public void setRsapublic(String rsapublic) {
+    this.rsapublic = rsapublic;
+  }
+
+  public String getSecertkey() {
+    return secertkey;
+  }
+
+  public void setSecertkey(String secertkey) {
+    this.secertkey = secertkey;
+  }
+}
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/user_api_controller.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/user_api_controller.kt
index 755d619..da943d3 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/user_api_controller.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/api/controller/user_api_controller.kt
@@ -360,19 +360,18 @@
      * 签约银行协议
      */
     @PostMapping("/signbxy")
-    fun signbxy(userid: String, code: String, phone: String): ResponseEntity<Any> {
-        val card = mobileApiService.findCardByUserid(userid)
+    fun signbxy(@RequestBody param:SignBxyParam): ResponseEntity<Any> {
+        val card = mobileApiService.findCardByUserid(param.userid)
                 ?: return ResponseEntity.ok(ResponseBodyBuilder.create()
                         .fail(400, "卡片不存在，请重新绑定"))
         //call sign api
         val person = userService.findOnePersonByUserid(card.userid)
-        val resp = citizencardPayService.signCard(card.cardno, person.name, person.idtype, person.idno, phone, YnrccUtil.TRANSTYPE_SIGNCARD, code)
+        val resp = citizencardPayService.signCard(card.cardno, person.name, person.idtype, person.idno, param.phone, YnrccUtil.TRANSTYPE_SIGNCARD, param.code)
         if (resp.code != "0000") {
             return ResponseEntity.ok(ResponseBodyBuilder.create()
                     .fail(500, resp.message))
         }
-        card.signed = true
-        mobileApiService.saveCard(card)
+        mobileApiService.signBxy(card,param)
         return ResponseEntity.ok(ResponseBodyBuilder.create()
                 .success("ok"))
     }
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/MobileApiService.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/MobileApiService.kt
index 55d717c..bbe2e84 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/MobileApiService.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/MobileApiService.kt
@@ -1,6 +1,7 @@
 package com.supwisdom.dlpay.mobile.service
 
 import com.supwisdom.dlpay.api.bean.BaseResp
+import com.supwisdom.dlpay.api.bean.SignBxyParam
 import com.supwisdom.dlpay.api.domain.TCard
 import com.supwisdom.dlpay.mobile.domain.TBMobileUser
 import com.supwisdom.dlpay.mobile.domain.TBPages
@@ -22,6 +23,8 @@
 
     fun saveCard(card:TCard):TCard
 
+    fun signBxy(card:TCard,param: SignBxyParam)
+
     fun sendSms(phone:String,code:String):BaseResp
 
     fun findByUseridAndStatus(userid:String,status:String):List<TBMobileUser>?
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/impl/MobileApiServiceImpl.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/impl/MobileApiServiceImpl.kt
index f9c2b1e..2aebcee 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/impl/MobileApiServiceImpl.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/service/impl/MobileApiServiceImpl.kt
@@ -2,8 +2,11 @@
 
 import com.mascloud.sdkclient.Client
 import com.supwisdom.dlpay.api.bean.BaseResp
+import com.supwisdom.dlpay.api.bean.SignBxyParam
 import com.supwisdom.dlpay.api.dao.CardDao
+import com.supwisdom.dlpay.api.dao.UserSecretDao
 import com.supwisdom.dlpay.api.domain.TCard
+import com.supwisdom.dlpay.api.domain.TUserSecret
 import com.supwisdom.dlpay.framework.service.SystemUtilService
 import com.supwisdom.dlpay.mobile.dao.MobileUserDao
 import com.supwisdom.dlpay.mobile.dao.PagesDao
@@ -29,6 +32,9 @@
     lateinit var pagesDao: PagesDao
 
     @Autowired
+    lateinit var userSecretDao: UserSecretDao
+
+    @Autowired
     lateinit var systemUtilService: SystemUtilService
     companion object {
         var isMsgLogined: Boolean = false
@@ -71,6 +77,28 @@
         return cardDao.save(card)
     }
 
+    override fun signBxy(card: TCard, param: SignBxyParam) {
+        card.signed = true
+        cardDao.save(card)
+        val optional = userSecretDao.findById(param.uid)
+        if (optional.isPresent) {
+            val userSecret = optional.get()
+            userSecret.userid = param.userid
+            userSecret.rsaprivate = param.rsaprivate
+            userSecret.rsapublic = param.rsapublic
+            userSecret.secertkey = param.secertkey
+            userSecretDao.save(userSecret)
+        } else {
+            val userSecret = TUserSecret()
+            userSecret.uid = param.uid
+            userSecret.userid = param.userid
+            userSecret.rsaprivate = param.rsaprivate
+            userSecret.rsapublic = param.rsapublic
+            userSecret.secertkey = param.secertkey
+            userSecretDao.save(userSecret)
+        }
+    }
+
     override fun sendSms(phone: String, code: String): BaseResp {
         var resp = BaseResp()
         var url = systemUtilService.getBusinessValue("sms.url")