The Ethereum Foundation and the Open Anonymity Project have developed zkAPI, a zero-knowledge protocol that enables users to pay for AI services and other paid APIs without linking their identity to their requests. Now live on the Ethereum mainnet, the system separates payment records from the prompts and queries sent to service providers, though it does not conceal all network activity or submitted content.
The Open Anonymity Project announced the collaboration in a September 25, 2026, post introducing its public AI chat services, OA-chat. The Ethereum Foundation subsequently promoted zkAPI on October 2 as a means for private artificial intelligence. The protocol was originally proposed by Ethereum researcher Davide Crapis and co-founder Vitalik Buterin, while the Open Anonymity team built the client, server, smart contracts, and browser integration.
How zkAPI Operates
Under the system, users begin by depositing ETH into the ZkAPIVault contract on the Ethereum mainnet. The deposit is converted into a commitment using a cryptographic data structure known as a Merkle tree, and the spending balance is stored as a private note directly on the user's device.
At the start of a session, the user's browser generates a zero-knowledge proof demonstrating that they possess sufficient funds and have not yet spent them. Payment verification occurs without revealing the specific deposit being used or the user's identity. Once verification concludes, an API key featuring a spending cap is issued, allowing the prompt to go directly from the browser to the AI provider. Upon expiration of the API key, a usage receipt is generated, and the corresponding amount is deducted from the private balance. A one-way serial number, or nullifier, is used to prevent double-spending.
The protocol relies on Groth16 proofs, BN254 cryptography, and Poseidon hashing to ensure verifiable and private payments. Additionally, users retain the ability to withdraw their remaining funds directly through the vault contract even if zkAPI servers cease operation.
Limitations and Privacy Boundaries
Developers note that zkAPI hides the payment link rather than the content itself. Service providers can still view prompts and network details such as IP addresses, and may attempt to correlate sessions using timing analysis. To counter this, developers recommend utilizing tools like Tor with a fresh circuit per session, as reused conversation histories, writing styles, or personal details can potentially allow providers to relink individual sessions.
