Token Approval

Overview

What it means and why it exists

Token approval is a permission that lets another account or smart contract spend a specified amount of a token on a holder's behalf. In ERC-20, it is commonly expressed as an allowance for a spender.

How it works

A wallet signs a transaction calling the token's approve function with a spender address and amount. The spender can subsequently call transferFrom within the authorized allowance, subject to token rules and the holder's balance. Some wallets and contracts use permits or signatures to establish allowances through related mechanisms without the same direct approval flow.

Technical details worth understanding

Approvals matter for checkout integrations that pull tokens, but many merchant payments are simple transfers with no prior allowance. Unlimited allowances reduce repeated approvals while increasing damage if the authorized contract or operator is compromised. Operators should identify the exact chain, token contract and spender before requesting permission.

What can go wrong

Approving a malicious spender can enable later asset removal even if the user never sends the payment they expected. Approval is not a successful merchant payment, and an approval transaction alone should never settle an invoice. Different tokens can have nonstandard allowance behavior.

Practical checks

A checkout team should ask whether token approval is necessary at all for its payment model. When it is, present the exact spender, token, allowance and duration; avoid unlimited permissions by default. In support guidance, explain how users can inspect and revoke standing allowances without surrendering their seed phrase.

Related concepts

Token, Stablecoin, ERC-20.

Further reading

ERC-20 Token Standard — EIP-20.