It's probably useful mostly to companies which want to avoid the security levels needed to comply with the Payment Card Industry Data Security Standard (PCI DSS). Consider a seller with a shopping cart program. One that outsources the collection of the payment data, and gives back a token. The token can be used for billing the customer, but the payor, payee, and maybe the shipping address are encapsulated in the token. So possession of the token only lets you submit new transactions that match on those items. The seller doesn't have to have PCI DSS compliance.

This is useful for systems which rebill the customer. They don't have to store the CVV, for which there are high security requirements. If an unauthorized party gets the token, they can cause rebilling, but not buy from others or, hopefully, change the shipping address. Also, in case of trouble, it's easy to invalidate tokens. People have to re-auth, but not get new credit cards.

It's a similar concept to OpenID, in some ways.

Can't say such things here. Apparently questioning OP's notivation and accusing of bias/spam/astroturfing is against HN rules. ¯\_(ツ)_/¯