Token Approvals Explained: Allowances, Unlimited Access and Revoking

Published 2026-10-26 · GetBestWallet editorial

Understand what token approvals permit and why disconnecting a DApp does not remove its allowance.

Key takeaway
A token allowance can let a spender move tokens without a new approval for each transfer. Check the chain, token, spender and amount; disconnecting a DApp does not remove that allowance.

What an allowance authorizes

Many ERC-20 tokens let an owner approve a spender contract to transfer tokens through transferFrom, up to an allowance. This is different from directly sending tokens to a recipient. A decentralized exchange may need that permission to execute a swap. The important identities are the network, token contract, owner and spender, not just the app’s displayed name.

Limited and unlimited approvals

A limited approval can cap exposure to the authorized amount, while an unlimited approval can remain usable for a much larger future balance. Exact behavior depends on the token and spender contracts. Some applications ask for broad permissions to avoid repeated approval transactions. Convenience should be weighed against the risk of a compromised spender or a mistaken authorization.

Check the approval request

Confirm the spender against the application’s official documentation, inspect the requested amount and consider whether a smaller allowance is supported. A contract’s source verification on an explorer does not prove that its behavior or upgrade controls are safe. Some wallets offer readable warnings or simulations; use them as additional evidence rather than a replacement for understanding the action.

Revoke through a trusted path

Use an official wallet feature or a carefully verified allowance-management tool on the correct network. Inspect the actual owner, token and spender before submitting a change, commonly setting the allowance to zero. Revocation normally costs network fees and only takes effect after confirmation. Disconnecting a website or deleting its browser permissions does not itself change the on-chain allowance.

Know what revocation cannot solve

A confirmed drain is not reversed by revoking afterward. An exposed private key remains compromised even if every visible allowance is removed. Signed permits, marketplace orders, NFT operator permissions and smart-account modules may require different responses from an ordinary ERC-20 approval. If an attacker is active, avoid blindly topping up gas in a wallet that may be monitored by automated sweepers.

A practical sequence

Identify the chain, owner account, token contract and spender. Compare the spender with the application's official documentation.
Inspect the requested allowance and use an appropriate smaller amount if supported. Reject a request you cannot explain.
To revoke, use a verified tool on the correct chain and confirm the transaction. Treat a leaked key as a separate incident; allowance changes do not secure that key.