How to Read a Wallet Connection Request
A plain-language framework for reviewing a dapp connection before approving it.
This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.
A connection request is the first time a website can ask your wallet for permission. Most people approve it without reading, because the dialog looks like a login box and login boxes are routine.
It is not a login. It is an authorization grant.
What the popup actually says
Wallet interfaces show the requesting domain, the network, and a list of permissions. Read all three.
The domain is the most important field and the easiest to skim past. Attackers register names that look identical to real protocols, so uniswapp-secure.com can sit directly under your attention next to the site you meant to visit.
The network field tells you which chain will be touched. If you expected Ethereum and the dialog offers a network you have never configured, stop.
The permission list tells you the scope. A request to see your token balances is narrow. A request to spend your tokens is not.
Permission types you will meet
- View balances: read-only access to public information in your address.
- Sign messages: can be harmless, but some signatures grant login rights to a service.
- Approve token spending: lets a contract move your tokens. Unlimited approval is the dangerous version.
- Access to NFTs or positions: lets the site enumerate and sometimes move specific assets.
Approvals persist. You can connect to a site today and the permission still sits in your wallet a year later.
How to check before approving
- Confirm you opened the site yourself, by typing the address or using a bookmark, not by following a link from a message.
- Compare the domain in the popup with the address bar character by character.
- Check the network matches the site you are on.
- Read each permission line. If any line requests spending, decide whether the site needs it for the action you want.
- Reject anything you cannot explain in one sentence.
If a legitimate site needs a spending approval to do what you want, you can grant it, use it, and revoke it afterwards in the same session rather than leaving it open.
After you approve
Revocation is available in every major wallet interface under the approvals or permissions section. A good habit is to revoke after each task rather than keeping a standing permission for a site you use once.
Never type your seed phrase or private key into a website. No legitimate connection flow ever asks for it.
Limits
Reading the dialog protects you from impersonated domains and unexpected permissions. It does not tell you whether a legitimate contract is well written. That requires reading the source code or relying on an audit you can verify.