What Is a Token Approval? Explained Simply

What Is a Token Approval?

A token approval is permission you grant a smart contract to move specific tokens out of your wallet on your behalf. Every DEX swap, NFT listing, and DeFi deposit starts with one. It is the most consequential click in crypto that almost nobody reads.

How It Actually Works

Token contracts keep an allowance ledger: which addresses may spend how much of your balance. When a DEX asks to "approve USDC," you are writing that ledger. Apps commonly request unlimited allowances so you never have to approve again, which is convenient in the same way leaving your car keys in every parking lot you have ever used is convenient. The approval persists until you explicitly revoke it, years later, whether or not you still use the app.

Why It Matters

If an approved contract is exploited, the attacker can spend everything the allowance covers, straight from your wallet, with no further signature from you.
Malicious sites disguise approval requests as harmless clicks. Signing one hands a drainer the ledger entry it needs.
Old approvals are silent liabilities. Your wallet's history is a list of every counterparty you have ever trusted, still trusted by default.

Risks and Common Mistakes

Approving unlimited amounts when the transaction needs fifty dollars. Set custom limits where the wallet allows.
Never auditing allowances. Review and revoke with Revoke.cash a few times a year, and immediately after touching anything sketchy.
Keeping approvals on a vault wallet. Long-term holdings belong in a wallet that has approved nothing, ever. The two-wallet habit on my Security page exists for this.

When It Matters

Every interaction with every dapp. Approvals are the plumbing under most drained-wallet stories, which is why they anchor the security cluster here alongside drainers and phishing.