The Ethereum Foundation introduced zkAPI on Oct. 1 alongside the Open Anonymity Project. The system is already live on Ethereum mainnet and lets users deposit ETH, USDC or other supported assets into an onchain vault before authorizing API usage with zero-knowledge proofs.
The idea is to break the connection between who pays and what they use.
Under the conventional API model, an API key is tied to an account and payment method, meaning a provider can potentially connect a long history of AI prompts or other requests to the same user. zkAPI instead creates short-lived spending credentials without revealing which deposit funded them.
zkAPI Separates AI Usage From Payment Identity
Users first deposit funds into an Ethereum smart-contract vault. Their balance is then represented privately, rather than being exposed each time they make an API request.
When a user needs access, their device generates a zero-knowledge proof showing that they have enough funds and have not already spent the same balance.
The zkAPI server verifies that proof and issues a short-lived API key with a defined spending cap. Prompts can then go directly from the user's device to the AI provider.
Crucially, the payment server does not see the prompt, while the AI provider does not learn which Ethereum deposit funded the request.
AI Is Only the First Use Case
The Ethereum Foundation says AI inference is the initial focus because prompts can contain particularly sensitive information, but zkAPI is not limited to AI.
The same infrastructure could eventually handle blockchain RPC calls, image and video generation, VPN bandwidth and machine-to-machine payments, allowing services to charge per request without requiring a persistent account.
The launch also fits into Ethereum's broader privacy push, which is targeting private reads, private transactions and identity protection through zero-knowledge cryptography.
There are still limitations. zkAPI hides the payment relationship, not everything about the request. The AI provider still sees the prompt itself and may receive network information such as an IP address. Repeated writing patterns or personal details inside prompts could also allow separate sessions to be linked.
