imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.
imtoken
中文Download
Home / DApp Connections
Step-by-step guide

DApp Connections

DApp Connections can become confusing when a wallet shows several networks, assets, or requests in one interface. Verify the domain and source before opening a DApp session. At the same time, confirm the active account and network when connecting. The practical consequence of a normal connection never asks for a seed phrase or private key is that visual familiarity is not enough; a user needs a repeatable method for checking source, target, network, and final state.

Before you begin
  • Use a trusted device and network
  • Confirm the active account and network
  • Read the full request before signing
On this pageBefore you begin: Verify the domain and source before opening a DApp sessionFirst execution stage: A normal connection never asks for a seed phrase or private keySecond execution stage: Signature requests after connection need separate reviewVerify the result: Disconnecting reduces unused sessionsCommon mistakes and recovery: Phishing DApps often use look-alike domains and urgency
01

Before you begin: Verify the domain and source before opening a DApp session

Focus on confirm the active account and network when connecting

First, in DApp Connections, the Before you begin: Verify the domain and source before opening a DApp session stage should not be reduced to the next button. Verify the domain and source before opening a DApp session. Confirm the active account and network when connecting. For DApp Connections, the user should confirm the object, then the action, then the result, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

First follow-up in DApp Connections: after the action described by Focus on confirm the active account and network when connecting, a success message should not be the only evidence used. A normal connection never asks for a seed phrase or private key. Account-sharing scope should match the purpose of the session. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to record the state before and after the action. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm verify the domain and source before opening a DApp session.
  • Check how confirm the active account and network when connecting affects the current request.
  • Use a normal connection never asks for a seed phrase or private key as a separate verification point.
02

First execution stage: A normal connection never asks for a seed phrase or private key

Focus on account-sharing scope should match the purpose of the session

Second, in DApp Connections, the First execution stage: A normal connection never asks for a seed phrase or private key stage should not be reduced to the next button. A normal connection never asks for a seed phrase or private key. Account-sharing scope should match the purpose of the session. For DApp Connections, the user should split a request into source, target, permission, and outcome, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Second follow-up in DApp Connections: after the action described by Focus on account-sharing scope should match the purpose of the session, a success message should not be the only evidence used. Signature requests after connection need separate review. Approval requests can create longer-lived contract permissions. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to treat network context as a prerequisite for every step. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm a normal connection never asks for a seed phrase or private key.
  • Check how account-sharing scope should match the purpose of the session affects the current request.
  • Use signature requests after connection need separate review as a separate verification point.
03

Second execution stage: Signature requests after connection need separate review

Focus on approval requests can create longer-lived contract permissions

Third, in DApp Connections, the Second execution stage: Signature requests after connection need separate review stage should not be reduced to the next button. Signature requests after connection need separate review. Approval requests can create longer-lived contract permissions. For DApp Connections, the user should understand why a confirmation is needed before approving it, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Third follow-up in DApp Connections: after the action described by Focus on approval requests can create longer-lived contract permissions, a success message should not be the only evidence used. Disconnecting reduces unused sessions. Revoking an on-chain approval requires a separate on-chain action. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to avoid repeated submissions when the current state is unclear. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm signature requests after connection need separate review.
  • Check how approval requests can create longer-lived contract permissions affects the current request.
  • Use disconnecting reduces unused sessions as a separate verification point.
04

Verify the result: Disconnecting reduces unused sessions

Focus on revoking an on-chain approval requires a separate on-chain action

Fourth, in DApp Connections, the Verify the result: Disconnecting reduces unused sessions stage should not be reduced to the next button. Disconnecting reduces unused sessions. Revoking an on-chain approval requires a separate on-chain action. For DApp Connections, the user should prefer public records that can be checked again later, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Fourth follow-up in DApp Connections: after the action described by Focus on revoking an on-chain approval requires a separate on-chain action, a success message should not be the only evidence used. Phishing DApps often use look-alike domains and urgency. After finishing, review any permissions that remain. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to keep secret recovery material separate from troubleshooting data. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm disconnecting reduces unused sessions.
  • Check how revoking an on-chain approval requires a separate on-chain action affects the current request.
  • Use phishing DApps often use look-alike domains and urgency as a separate verification point.
05

Common mistakes and recovery: Phishing DApps often use look-alike domains and urgency

Focus on after finishing, review any permissions that remain

Fifth, in DApp Connections, the Common mistakes and recovery: Phishing DApps often use look-alike domains and urgency stage should not be reduced to the next button. Phishing DApps often use look-alike domains and urgency. After finishing, review any permissions that remain. For DApp Connections, the user should manage long-lived permissions separately from one-time transactions, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Fifth follow-up in DApp Connections: after the action described by Focus on after finishing, review any permissions that remain, a success message should not be the only evidence used. Verify the domain and source before opening a DApp session. Confirm the active account and network when connecting. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to ask what every signature proves or changes. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm phishing DApps often use look-alike domains and urgency.
  • Check how after finishing, review any permissions that remain affects the current request.
  • Use verify the domain and source before opening a DApp session as a separate verification point.

Practical checklist

  • Review verify the domain and source before opening a DApp session.
  • Review a normal connection never asks for a seed phrase or private key.
  • Review signature requests after connection need separate review.
  • Review disconnecting reduces unused sessions.
  • Review phishing DApps often use look-alike domains and urgency.

Continue learning

Web3 & DApps Signature Requests Approval Security