Token approvals (often called allowances) are the ERC-20 pattern that lets a smart contract spend tokens from your account. You click "Approve" in a dApp, the contract gets an allowance, and later it can call transferFrom to move your tokens without asking again. Simple. Dangerous when you approve an unlimited allowance and forget about it.
Why should you care? Because a malicious or compromised contract with an active allowance can drain the token it has access to. I've made the mistake of approving a router contract for testing and had to spend gas to clean up later. Want to avoid that hassle? Check approvals regularly.
Don't confuse "disconnecting" a dApp from MetaMask with revoking a smart contract allowance. They are different controls:
But many people assume disconnecting equals revoking. It doesn't. So check both when cleaning up access.
Two practical ways I use when auditing an account.
(If you see a long list, export or screenshot the results so you can track what you changed.)
There are two common approaches: interact with the token contract directly, or use an allowance manager that builds the transactions for you.
Method A — Direct contract interaction (Etherscan Write Contract)
approve function. Enter the spender address and 0 as the amount.Notes: this only works when the contract is verified and exposes the standard approve function. Some tokens use decreaseAllowance or custom flows—if so, use the function provided or an allowance manager.
Method B — Allowance manager (UI-driven)
Advantages: UI is easier and lists spenders in plain language. Disadvantages: you must connect a third-party site (so double-check the URL and the contract addresses).
| Method | Where | Requires connection | Gas | Pros | Cons |
|---|---|---|---|---|---|
| Explorer (Write contract) | Desktop | Yes (to write) | On-chain | Direct contract call, no third-party manager | Must be verified; manual |
| Allowance manager | Desktop/mobile | Yes | On-chain | Easy list, one-click revokes | Requires trusted UI; watch for batch helpers |
| MetaMask "Disconnect" | In MetaMask | No | None | Quick disconnect from site | Does NOT revoke token approvals |
![approvals-ui-placeholder]
MetaMask mobile supports two practical paths.
In my experience the in-app browser is the fastest on the go. And yes, that means you must be careful which sites you connect to when using your phone.
Revocation is an on-chain transaction and costs gas on the chain where the token lives. A few practical points:
But don’t panic if a single revoke costs a bit of gas. It’s insurance against much larger losses.
Who this is for:
Who should look elsewhere:
Q: Is it safe to revoke approvals using a third-party site? A: Connecting to a reputable allowance manager to read approvals is generally safe, but you must confirm the site URL and verify the spender addresses before revoking. Never enter your seed phrase.
Q: How do I revoke token approvals in MetaMask?
A: Use an allowance manager or interact with the token contract’s approve function on the explorer and set allowance to 0. MetaMask will prompt to sign the revoke transaction.
Q: What happens if I lose my phone after revoking or connecting? A: Revocation transactions live on-chain and remain effective. If you lose access to the phone, restore via your seed phrase on a new device (see backup-and-recovery-options).
Revoking token approvals is a small recurring task that reduces risk. Do it monthly or after interacting with any new dApp. In my experience, paying a small gas fee to revoke an old unlimited allowance is better than paying much more to recover stolen funds.
For practical next steps: check your approvals now (copy the address from MetaMask), review connected sites (see connect-to-dapps), and follow our guides on token-management and security-best-practices to tighten things up.
Want a walkthrough for mobile or desktop with screenshots? See how-to-revoke-approvals and the linked setup guides: setup-desktop | setup-mobile.
But don’t make it optional — make it routine.