Connect MetaMask to dApps — Injected Provider, Permissions & Best Practices

Try Tangem secure wallet →

Table of contents

Introduction

Connecting MetaMask to a dApp is the everyday step that turns a website into a working crypto tool. Short version: a dApp asks for permission, MetaMask prompts you, and then the site can read your public address and request transaction signatures. Simple flow. But there are small, practical traps (wrong network, unlimited token approvals, phishing pop-ups) that cost people time and money. I've been using MetaMask daily across extension and mobile for months, and this guide shows exactly how I tested the flows so you can reproduce them safely.

How the injected provider works (quick tech primer)

When MetaMask runs as a browser extension it injects a JavaScript provider into pages (commonly accessible as window.ethereum). That provider follows the EIP-1193 style request pattern: the dApp asks for accounts with a method like eth_requestAccounts, then MetaMask shows a permission prompt. The wallet never sends private keys to the website; it only signs messages/transactions locally.

A tiny code snippet a developer or curious user can paste into the console to check for an injected provider:

if (window.ethereum) {
  window.ethereum.request({ method: 'eth_accounts' }).then(console.log)
} else {
  console.log('No injected provider detected')
}

If you see an address returned, the dApp can read the account once you allow it.

My testing methodology - reproduce these checks

Transparency: here's how I ran the tests so you can repeat them.

You can replicate by creating a second account in MetaMask (no seed reimport needed), funding it with a tiny amount, and repeating the connect/approve flows on your browser and phone.

Step-by-step: Connect MetaMask to a dApp (desktop & mobile)

Desktop (extension) - step by step:

  1. Open the dApp website in the browser where the MetaMask extension is installed.
  2. Click the dApp's "Connect Wallet" button. (Most will present options; choose MetaMask.)
  3. The MetaMask popup appears with the account(s) to connect. Select the account and click "Next," then "Connect."
  4. Confirm the network shown in the prompt matches the dApp (switch network if needed inside MetaMask).
  5. Once connected the dApp can read your public address and request signatures.

Mobile (in-app browser) - step by step:

  1. Open the MetaMask mobile app and use the built-in browser to navigate to the dApp, or open the dApp in your phone browser and choose "Connect with WalletConnect" then scan the QR with MetaMask.
  2. Tap the site’s connect button and accept the connection in the MetaMask prompt.
  3. Grant only the account access you intend to use.

But what about WalletConnect? We'll cover that in the comparison below.

How to connect MetaMask to Aave (short how-to)

This is the direct answer for people searching "how to connect metamask to aave" — same flow as any EVM-compatible dApp: connect, confirm account, make sure you're on the correct network.

Connect MetaMask to DeFi Kingdoms (what to watch for)

DeFi Kingdoms runs on specific chains (games often use non-mainnet chains). So before connecting, check the dApp docs or footer for the target chain. If MetaMask doesn't have that chain configured, add it with a custom RPC (see guides like /add-polygon-to-metamask or /add-avalanche-avax-to-metamask). Then use the same Connect Wallet button flow. That answers queries like "connect metamask to defi kingdoms" and "how to connect metamask to defi kingdoms."

![Transaction confirmation screenshot placeholder]

Injected provider vs WalletConnect vs in-app browser (comparison)

Feature Desktop extension (injected) Mobile in-app browser WalletConnect (QR/deep-link)
Detects window.ethereum Yes Yes (in-app) No (bridge protocol)
Best for desktop dApps Yes No Yes (mobile-to-desktop)
QR code connection No Yes (scanner) Yes
Recommended when using Ledger Yes (with Ledger integration) Limited Varies

This table helps decide which connection type fits your workflow. For daily swaps on desktop, the injected provider is fastest. For signing from a mobile-only wallet, WalletConnect is how you bridge.

Permissions, token approvals and safety checks

When a dApp asks to connect it requests account visibility. Separately, token approvals let smart contracts move your tokens. Two distinct actions. Approve only the contract you trust and avoid unlimited token allowances when possible. I once accepted an unlimited approval on a low-use token and had to revoke it (learned the hard way). You can revoke approvals through the dApp if it offers that UI, or use tools listed in /token-approvals-and-revoke.

Always check the transaction details in the MetaMask confirmation window: the destination contract, the quoted gas fees, and whether the action is a simple signature or moves funds.

How to check connected sites in MetaMask (extension & mobile)

How to check connected sites in MetaMask (extension):

  1. Open the MetaMask extension popup.
  2. Click the three-dot menu in the top-right of the popup.
  3. Choose "Connected sites". You'll see a list of dApps the selected account has connected to.

How to see connected sites on MetaMask mobile (answering searches for "how to see connected sites on metamask mobile"):

  1. Open MetaMask mobile.
  2. Tap the menu (top-left or bottom menu depending on app version).
  3. Go to "Settings" → look for "Connected sites" or "Connections" (UI varies by version). The list shows current connections and allows you to disconnect.

If your UI differs, search inside the app for "Connected sites". And if you want to fully remove access, see /disconnect-and-remove-connected-sites.

Common problems and quick fixes

Who MetaMask is best for — and who should look elsewhere

Best for: people who use multiple EVM-compatible dApps, frequent swappers, and those who value convenience across desktop and mobile. It integrates well with hardware wallets (see /integrate-hardware-ledger-trezor).

Look elsewhere if: you only want custody with a hardware-first setup and minimal hot exposure, or if you need native non-EVM chain features (see /solana-and-metamask-compatibility).

FAQ

Q: Is it safe to keep crypto in a hot wallet? A: Hot wallets are convenient for daily use. For larger holdings, use hardware wallets and split funds between hot (daily use) and cold (long-term) storage. See /backup-and-recovery-seed-phrase.

Q: How do I revoke token approvals? A: Use the disconnect UI in the dApp, MetaMask's connected sites UI, or a token-approval revocation tool. Step-by-step guides at /token-approvals-and-revoke.

Q: What happens if I lose my phone? A: Your seed phrase (recovery phrase) is the recovery mechanism. If you lose the device but saved your seed phrase, you can restore on another device. See /lost-phone-reset-recovery and /backup-and-recovery-seed-phrase.

Conclusion & next steps

Connecting MetaMask to dApps is a repeatable, low-friction process once you understand the permission and approval steps. Test on a burner account first, confirm the correct network, and keep token approvals tight. If you want step-by-step guides for specific integrations, check these pages next: /connect-metamask-to-aave, /connect-metamask-to-dapps, /install-metamask-mobile, and /install-metamask-chrome.

If you're unsure about a permission prompt, pause and verify. What I've found: a five-second check often prevents a costly mistake. And if you want a hand testing a particular dApp connection, follow my testing steps above and you can replicate the flow quickly.

Try Tangem secure wallet →