A safe, stand-in reference that a payment gateway hands your server instead of the real card number. You can use it to complete a charge, but it's worthless to anyone who steals it.