The Block reported on October 1 that the Ethereum Foundation and the Open Anonymity Project had launched zkAPI, an experimental system for paying AI models and other metered APIs through a vault, local zero-knowledge proving and temporary API credentials. Users deposit ETH or USDC, generate a proof on their own device, and receive a spending-limited key that can be used with a provider.
zkAPI hides the deposit note’s direct link to a particular AI request, rather than making the request itself or the service relationship disappear. It can prevent a provider from tying a spent note to the deposit that funded it, while still exposing provider-side metadata and usage metering, and still relying on an honest gateway to enforce policy and an atomic reservation process to prevent double spending. zkAPI is best understood not as anonymous money bolted onto an AI chatbot, but as a billing protocol with a privacy layer. It turns a routine commercial act, paying for a request, into a chain of cryptographic statements about authorization, uniqueness, limits and settlement.
The central design goal is provider unlinkability. A model provider should be able to serve a paid request without learning which onchain deposit funded it or obtaining a payment identity that follows the customer across sessions. Achieving that goal requires more than hiding a wallet address. It requires a note system, a commitment set, nullifiers, strict handling of request data and a credible answer for every awkward case: expired keys, failed calls, partial usage, refunds and a lost client secret.
What a proof needs to establish
A zero-knowledge proof is not a generalized declaration that “this user has money.” In a sound zkAPI design, the proof should establish a much more precise claim:
I know a valid, unspent note included in the approved vault state, and I am authorized to use it to obtain an API allowance under these exact terms.
The prover, normally software running locally on the customer’s device, keeps the witness private. The witness may include a secret, note randomness, note value or policy parameters, and a Merkle path showing that a commitment corresponding to the note belongs to the vault’s commitment tree. The verifier, which may be the zkAPI server or payment gateway, receives only public inputs and a proof.
The commitment tree matters because it lets a proof refer to a large anonymity set rather than reveal a specific deposit. When a user funds the vault, the system creates a commitment, a cryptographic fingerprint of a note. That commitment is inserted into a public tree. Later, the user proves membership in the tree without revealing which leaf is theirs.
The proof should also bind the authorization to a specific billing context. That normally means public inputs or signed fields covering the API provider or gateway, the allowance, a credential expiry, a request nonce or session identifier, and perhaps a price schedule version. Without that binding, a valid proof might be transplanted to a different provider, a more expensive product tier or a future session that the user never intended to authorize.
This distinction is crucial. Privacy comes from hiding the note identity. Security comes from making the statement exact enough that a proof cannot be reused outside its intended commercial context.
The note lifecycle, from deposit to spent balance
The lifecycle begins with a vault deposit. The user transfers supported assets into the vault contract, while their client derives a private note and publishes its commitment. The chain reveals that a deposit occurred and may reveal its token amount, timing and transaction sender. It does not, by itself, reveal which later private payment consumes that deposit.
A user then asks the local client for an allowance, such as a capped amount of API spending. The client selects an eligible note, derives a nullifier, constructs the proof and sends the proof to the gateway. If accepted, the gateway issues a short-lived API key with defined spending constraints. The user sends prompts directly to the model provider with that key, while usage is eventually deducted against the private balance. The reported implementation uses temporary API keys and deducts usage after expiry.
⛓ marks on-chain stages; “private witness stays local” applies above stages 3 and 4
That summary conceals an important accounting choice. A metered service rarely knows the exact final bill before work starts. An image request can fail after consuming compute. An agent can make a variable number of tool calls. A language model can produce fewer or more output tokens than expected.
The cleanest answer is a reservation model. The proof authorizes a maximum amount, not an unbounded tab. The gateway locks that amount against the note, issues a key capped at that amount and later charges actual measured usage. The remainder must become spendable again, either by releasing a reservation or by creating a change note.
A system that simply publishes a nullifier at the start has chosen finality before the exact charge is known. That is secure against double spending, but inconvenient if the user receives less than the reserved service. A system that waits to nullify until final settlement must prevent the customer from obtaining multiple simultaneous allowances from the same note. The protocol cannot leave that interval vague.
Nullifiers stop double spending, but only if timing is right
A nullifier is a deterministic, pseudorandom-looking identifier derived from a note secret and usually a domain separator. Spending the same note twice produces the same nullifier. The verifier can reject the second attempt without learning which commitment generated it.
That is the core double-spend defense. The nullifier set is public or shared among the authorized settlement parties. Before accepting a proof, the verifier checks that the proposed nullifier is absent. Once spending is accepted, it records that nullifier. A duplicate signals an attempt to reuse the same note.
But a nullifier alone does not solve concurrency. Imagine two gateway instances receiving valid proofs for the same note milliseconds apart. If each checks the nullifier before either one records it, both could issue a temporary key. The back end needs an atomic reserve operation, a single authoritative ledger, or a cryptographically enforced state transition. In other words, private payments still require conventional distributed-systems discipline.
Replay resistance is related but distinct. A malicious party could copy a proof from the network and submit it again, even if they do not know the note secret. Binding the proof to a gateway-specific challenge, a short expiry, an intended allowance and a request or session nonce narrows that opportunity. A captured proof becomes useless outside the one intended authorization context.
The temporary key itself also needs controls. It should have a short lifetime, a provider audience, a spending cap, rate limits and an identifier that lets the gateway stop it when its allowance is exhausted. If a key is a bearer credential, whoever steals it can use it until it expires. ZK cannot repair poor key custody at the application layer.
Privacy is not anonymity
The protocol can hide the relationship between a particular deposit commitment and an accepted API payment. That is valuable. It does not mean the provider cannot identify, profile or correlate the user through other channels.
The gateway still sees the connection used to submit the proof. The provider may see an IP address, browser and device signals, TLS behavior, timing patterns, usage volumes and prompt content. A user who repeatedly requests help with their employer’s internal project, writes in a recognizable style or continues a lengthy conversation may create a linkable profile even when the underlying payment note remains hidden.
The Block noted that zkAPI does not provide network anonymity and that stable IP addresses or prompt content may allow correlation. It also reported that the project describes itself as experimental.
This creates two separate privacy promises:
| Layer | What it can protect | What it may still expose |
|---|---|---|
| Cryptographic payment privacy | The deposit note funding a request | Deposit timing, vault transaction patterns, token denomination |
| Operational privacy | Potentially less identity linkage | IP address, prompts, provider logs, device fingerprints, usage timing |
For a business buyer, this distinction matters more than the word “private.” A developer may be comfortable hiding wallet linkage while accepting provider logging for abuse prevention and service debugging. A whistleblower, political dissident or company protecting commercially sensitive prompts has a much stricter threat model. They need network privacy, cautious prompt hygiene and a provider whose retention practices match the risk.
Settlement, refunds and the trust boundary
The billing system must specify who measures usage and who can dispute it. If the provider reports token counts or compute usage to the gateway, the gateway is trusting the provider’s meter. If the gateway proxies all traffic and counts usage itself, it gains better billing control but sees more operational metadata. If the client calculates cost locally, it cannot reliably attest to what the provider actually served.
There is no cryptographic shortcut around this commercial fact. A proof can show authorization for a maximum charge. It cannot prove that a proprietary model generated exactly 837 output tokens, that an image model consumed a stated amount of GPU time, or that an API response was useful.
A practical settlement design should therefore have explicit states: authorized, reserved, partially consumed, settled, released and disputed. It should define what happens when the provider times out, the gateway goes offline after issuing a key, or the client disappears mid-session.
Refunds are particularly revealing. An onchain withdrawal can return remaining funds to a user-controlled address, but it may weaken privacy if the withdrawal amount and timing uniquely match a deposit or spending pattern. A private refund path should create fresh notes or use withdrawal mechanisms designed to avoid direct linkability. It also needs a policy for unclaimed balances and fees, because a privacy system that strands small residual amounts becomes expensive in practice.
Client key loss is another nontrivial risk. If note secrets exist only on one laptop and that device is lost, the funds may be unrecoverable. Recovery options, such as backups, social recovery or encrypted cloud copies, introduce new attack surfaces. Any product considering zkAPI must decide whether irrecoverability is acceptable, or whether usability demands a recovery mechanism that partially compromises the strongest privacy model.
Is it ready for real API billing?
On the evidence reported so far, zkAPI provides a vault-funded payment path, local proof generation, temporary spending-limited API credentials and delayed deduction of measured usage after those credentials expire. It also offers a limited privacy property: the provider need not receive the onchain deposit identity that funded a request. The report does not establish, however, the exact proof statement, the nullifier publication and reservation timing, the concurrency controls, the binding of an allowance to a provider and price schedule, or the rules for partial charges, refunds and disputes.
Those mechanisms are therefore requirements or proposed designs in this article, not confirmed properties of the reported implementation. That gap is the readiness verdict: zkAPI may demonstrate private authorization and credential issuance, but it is not yet possible from the public description to verify that it supplies a complete, race-safe and fairly settled billing system for real metered APIs.
Its unresolved risks are clear: first, atomic reservation under concurrency; next, provider-bound proof authorization; and finally, trustworthy usage metering with privacy-preserving refunds.
For low-value experimentation, the design can be attractive if users accept that the provider and gateway remain operationally important. For higher-value or sensitive workloads, an audit should ask four direct questions: Can a note be reserved twice under concurrency? What exactly binds a proof to a request and provider? Who has authority over usage metering and refunds? Which metadata can still link sessions?
If those answers are concrete, zkAPI can become a useful privacy primitive for API commerce. If they are left as implementation detail, its cryptography may be sound while its billing system remains fragile.
David Smith is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at David Smith's usual length and in David Smith's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 11/5/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.