imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.

Security Center

Token Approvals

The goal of Token Approvals is to build repeatable security habits rather than create fear. Seed phrases and private keys remain under the user’s control, and legitimate support should never ask for them. Every signature, approval, transfer and unfamiliar link should be evaluated by source, scope and likely on-chain effect.

Understanding approval target

Approval target deserves its own verification step when working with Token Approvals. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Token Approvals workflow, approval target should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

How allowance amount affects the workflow

Allowance amount deserves its own verification step when working with Token Approvals. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Token Approvals workflow, allowance amount should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

  • Confirm that the action matches your goal for allowance amount
  • Verify the address, network and amount before a transfer
  • Review the target and permission scope before signing or approving
  • Check transaction history and on-chain status after completion

Working with unlimited approvals

Unlimited approvals deserves its own verification step when working with Token Approvals. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Token Approvals workflow, unlimited approvals should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

Revoking approvals and risk checks

Revoking approvals deserves its own verification step when working with Token Approvals. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Token Approvals workflow, revoking approvals should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

  • Confirm that the action matches your goal for revoking approvals
  • Verify the address, network and amount before a transfer
  • Review the target and permission scope before signing or approving
  • Check transaction history and on-chain status after completion