Ethereum's zkAPI brings privacy-preserving API payments to mainnet

What happened

Ethereum's zkAPI is now live on mainnet. The Ethereum Foundation announced on Thursday that the system, built with the Open Anonymity Project, lets users pay for AI and other API services without revealing their billing identities. The release turns an earlier zero-knowledge API payment proposal into a working mainnet implementation.

Users deposit ETH or USDC into an Ethereum vault contract. The contract records the balance as a private note, and software on the user's device creates a zero-knowledge proof when a payment is due. A zkAPI server checks the proof before issuing a temporary API key with a spending limit. A published nullifier prevents users from spending the same balance twice.

The launch follows a February proposal by Ethereum Foundation researcher Davide Crapis and Ethereum co-founder Vitalik Buterin for ZK-based API usage credits. The project has also released a local client and software development kit, along with a browser-based AI chat implementation.

Why it matters

The protocol addresses a privacy gap in AI API payments. Traditional API interactions embed identity into every request, and standard API credentials tie directly to user accounts and payment instruments, creating behavioral profiles from each interaction. zkAPI separates payment records from API activity, so users can pay without giving providers an account identity tied to every request.

The client supports OpenAI and Ollama APIs on a machine. By emulating those protocols on local machines, users can connect their preferred applications through localhost configurations without modification. The Ethereum Foundation lists AI chat, AI agents, blockchain RPC access, image and video generation, VPN bandwidth, and machine-to-machine payments among uses.

Privacy has limits. zkAPI does not hide a user's network address, and a gateway may still connect repeated requests from the same IP address. Prompt content can also reveal identity. Personal details, writing habits, or conversation history may reconnect separate sessions. Users seeking network privacy can route traffic through Tor.

What is still unclear

• It is unclear how gateway operators will handle correlation risks from consistent network locations.
• It is unclear whether the experimental label will limit production use.
• It is unclear how prompt content could reconnect separate sessions in practice.

Questions readers ask