Solana token approvals · SPL Token + Token-2022
Every time you approve a delegate, someone else can move your tokens until you take it back. Unhookr lists every standing approval in your wallet, names who holds it when we can, and lets you revoke them all in one signature.
Looking needs no wallet. To revoke, connect the wallet that owns the tokens — it signs, Unhookr never sees your keys.
We read every token account your wallet owns under both token programs (classic SPL Token and Token-2022) straight from mainnet, and look at four fields: the delegate, the close authority, the account state, and the mint's permanent-delegate extension.
For each party we check what it is on-chain: a program we recognise, an account owned by such a program, a program-derived address, or a plain wallet. If we can't recognise it we say "unknown wallet" — we never guess.
Revoke instructions are built in your browser, several per transaction, and simulated before you sign. Your wallet signs them all at once, we relay them, wait for confirmation and scan again so you see the before and after.
After a Revoke, the delegate can no longer move tokens from that account. That's all it does, and it takes effect as soon as the transaction confirms.
Tokens a delegate already moved are gone. Revoking stops the next transfer, not the last one. If you were drained, also move what's left to a fresh wallet.
Some Token-2022 mints name a permanent delegate when they're created. It can move or burn any holder's balance of that token, and nobody — not you, not us — can revoke it. Many stablecoins and regulated tokens use one for compliance. The only exit is not holding the token.
The token program refuses to change a frozen account. Programmable NFTs are frozen on purpose; their delegates are managed through the marketplace or Metaplex tools that set them.
If someone else holds an account's close authority, only they can change it. They can close the account once it's empty and keep the rent. Your tokens stay safe while there's a balance, but consider moving them to a fresh account.
Unhookr never asks for a seed phrase or private key. Our relay only forwards transactions whose every instruction is a token Revoke (plus fee settings) — it checks the bytes before sending.