On October 1, 2026, the Ethereum Foundation’s dAI team and the Open Anonymity Project placed zkAPI on Ethereum mainnet, a payment layer that lets people buy metered API access—especially AI inference—without tying the payer’s identity to the requests themselves.
Today’s typical AI key points back to an account and a payment method, so every prompt joins a lasting profile.
Questions about health, money, or personal doubts become a continuous record held by whoever bills the service.
Paying each call directly on-chain is slow, costly, and publicly linkable; trusting an intermediary simply moves the same problem.
zkAPI splits the billing relationship from the conversation.
A user sends a single ordinary transaction that deposits ETH, USDC, or similar assets into a vault contract.
After that, the balance lives as a private note—spendable only by its holder and not traceable by outsiders back to the original deposit.
Local software later produces a zero-knowledge proof stating that some funded, previously unspent note covers a bounded amount.
The proof can authorize one call or an entire session.
A server verifies the statement without learning which note, which deposit, or which person stands behind it.
At the payment layer, successive requests remain unlinkable both to the user and to one another.
Commitments sit inside a Merkle tree, so a proof can demonstrate membership among valid notes without identifying any particular leaf.
Each spend also publishes a nullifier, a one-way serial derived from the note’s secret.
Staying inside the balance keeps activity unlinkable; attempting to reuse the same funds produces a duplicate nullifier that flags the double-spend and reveals nothing else.
In the preferred flow, an application talks to a small client on the user’s own device and continues to speak its usual API.
That client forwards only a payment proof to the zkAPI server.
The server mints a fresh, short-lived key capped in dollars; the key never leaves device memory.
Prompts then travel directly from the device to the model provider under that key.
When the key expires, a signed usage receipt records actual consumption, and the server deducts that amount from the private note rather than the reserved cap.
Neither side can later rewrite the bill, and one authorization covers a whole session.
A simpler proxy mode exists in which the zkAPI server relays traffic, but the direct-key path ensures the payment intermediary never sees content.
Spend proofs use Groth16 on the BN254 curve, Poseidon hashing for commitments and nullifiers, and a 32-level Merkle tree.
The server checks spend proofs off-chain; the vault contract checks equivalent proofs for deposit, close, and escape, so funds can be withdrawn even if every server disappears.
Existing tools need no rewrite: the local client exposes standard OpenAI– and Ollama-compatible endpoints, so editors and chat apps simply point at localhost.
The information split is deliberate.
The zkAPI server learns only that a valid payment exists and the dollar total for a session; it never sees identity, prompts, or which deposit funded the key.
The AI provider sees prompts and responses because it runs the model, yet never learns who is paying.
The public Ethereum chain records deposits, closures, and withdrawals, but not what any balance purchased.
The same pattern extends beyond chat to blockchain RPC queries, image and video jobs, VPN bandwidth, and machine-to-machine tasks.
Providers integrate by accepting a proof in place of a long-lived account key and settling signed receipts; their pricing and rate limits stay unchanged.
The design does not claim full anonymity.
A stable IP address can still let a gateway correlate request patterns, and reused personal details or writing style inside prompts can re-link sessions for anyone who reads the content.
Users who want stronger network privacy can route through Tor with a fresh circuit per session. Content privacy remains a separate problem addressed by other techniques.zkAPI implements a February 2026 Ethereum Research proposal by Davide Crapis and Vitalik Buterin.
The protocol is live, with a public vault, testnet deployment, browser chat, and open client and server code, though the project itself describes the system as experimental.