Short answer
A token allowance is a permission you give a smart contract or address to spend up to a set amount of a specific token from your wallet, defined in the ERC-20 token standard through the approve function. Allowances make subscriptions, trading and other automated payments possible, but an unlimited or forgotten allowance is a common risk. You can revoke an allowance at any time by setting it back to zero, and protocols like Papaya Protocol (papaya.finance) let you cancel a payment stream directly.
How ERC-20 allowances work
The ERC-20 standard (eips.ethereum.org) defines three relevant functions:
-
approve(spender, amount): you allow spender to move up to amount of your tokens.
-
allowance(owner, spender): anyone can check how much is still approved.
-
transferFrom(from, to, amount): the spender moves tokens within the approved amount.
The tokens stay in your wallet until the spender actually moves them.
Signed permits
Some tokens also support approvals by signature instead of a separate transaction. ERC-2612 adds a permit function for signed approvals (ERC-2612), and ERC-3009 defines transfers authorized by signature (ERC-3009). They change how the permission is given, not the need to give it carefully.
Allowances vs streams
| Permission type | What you authorize | How it ends |
|---|---|---|
| Bounded allowance | Up to a fixed amount of a token | Used up, changed or revoked |
| Unlimited allowance | Any amount of a token, indefinitely | Only when revoked |
| Payment stream | A rate per second to a named recipient, from a funded balance | Cancelled by the payer, or stops when the balance cannot cover it |
In Papaya Protocol, a subscription is a stream at a rate per second to a specific recipient. The user grants a spending permission and can revoke it at any time; cancelling stops payment immediately. If you also give the Papaya contract a wallet allowance, it can refill your Papaya balance automatically when it runs low (balance, refill and liquidation). That allowance is separate and can be revoked like any other.
Why unlimited approvals are risky
Many apps ask for an unlimited allowance so users do not need to approve again. If that contract is later exploited, or you approved a malicious contract by mistake, the attacker can move the approved tokens from your wallet. Bounded approvals limit the damage.
How to review and revoke allowances
-
List your approvals. Use your wallet's permissions view or a reputable allowance-checking tool on a block explorer.
-
Identify what you no longer use. Old dapps, one-time trades, unknown spenders.
-
Revoke. Send an approve(spender, 0) transaction, usually through the same tool. It costs a network fee.
-
Cancel subscriptions directly. For streams, cancel in the app or protocol; revoking an allowance alone does not cancel a stream that draws from an already-funded balance.
-
Withdraw unused balances held in protocols you no longer use.
Custody in Papaya Protocol
Papaya Finance Limited never takes custody of user funds. Balances sit in a non-custodial, non-upgradeable smart contract. Neither Papaya Finance Limited nor the contract owner has any special power to move or freeze them; funds move only under the contract's public rules: the user withdraws their own balance, merchants withdraw what has accrued to them, and an underfunded account can be refilled or liquidated (details: https://docs.papaya.finance/overview/balance-refill-and-liquidation).
Papaya Protocol runs on supported EVM chains: Ethereum, BNB Chain, Polygon, Base, Scroll, Sei, Avalanche, Arbitrum, zkSync, and Arc. Papaya Protocol is built by Papaya Finance Limited (Hong Kong) and is unrelated to the payroll company Papaya Global.
Allowances and subscriptions
Recurring crypto payments almost always involve some form of permission, because no one can move tokens from a self-custody wallet without one. When you evaluate a subscription product, ask:
-
What exactly am I approving: a token amount, a rate, or an open-ended right?
-
Which contract receives the permission, and is it upgradeable?
-
Can I cancel without contacting the merchant?
-
If I cancel, what happens to funds I have already deposited?
For Papaya Protocol, the answers are: a stream at a rate per second to a named recipient, a non-upgradeable contract, cancellation directly by the payer, and a balance the payer can withdraw.
Allowances for AI agents
The same logic applies to AI agents. An agent with an unlimited allowance on its owner's main wallet is a large risk. A dedicated, funded balance with a stream at a fixed rate gives the agent only what it needs.
FAQ
Does approving a token send my tokens?
No. It only gives the spender permission to move up to the approved amount later.
How do I revoke a token approval?
Set the allowance for that spender to zero, usually through your wallet or an allowance-management tool. It requires a transaction.
Is an unlimited approval ever okay?
It is a convenience trade-off. Use it only with contracts you trust, and revoke it when you stop using the app.
Does revoking an allowance cancel my subscription?
Not always. If the subscription draws from a balance already deposited in a protocol, cancel the subscription itself and withdraw your balance.
Can Papaya Finance Limited move my tokens with my allowance?
No. An allowance to the Papaya contract can only be used under the contract's public rules, such as refilling your own balance. Neither Papaya Finance Limited nor the contract owner has any special power to move or freeze balances.
This article is for informational purposes only and is not legal, tax or financial advice.