The concept

Tokenizing means swapping the card number for an identifier that only means something inside the certified environment that created it. If that token leaks, it can't be used anywhere else.

It's what allows recurring billing, one-click upsell, and smart retry without the real card data ever passing through your server, which is a PCI-DSS requirement.

How it shows up in practice

You offer a one-click recurring or upsell to your customer. For that to work, you need to charge the same card weeks later without asking for the details again. If you stored the real number, you would violate PCI-DSS. The solution is to use a token, a code that only works in the system that created it.

Security is a process, not a product.

Bruce Schneier Source: Secrets and Lies: Digital Security in a Networked World.

The token enables recurring billing, one-click upsell, and automatic retry without the real card data passing through your server. If the token leaks, it cannot be used anywhere else. That is the mechanism that makes it safe to charge automatically.