Ethereum zkAPI Explained: What Private AI Payments Hide and Show

On 1 October 2026, the Ethereum Foundation announced zkAPI, a tool it says “lets you pay for a metered API without being known.” The Block reported the launch the same evening. The same blog post also says, in plain words, that the AI company still sees what you ask and your internet address.

So, per the Foundation’s own post, this is private paying, not invisibility. This is an explainer, not a how-to, so we won’t cover deposits or setup. The useful skill here is asking any privacy claim three things: hidden from whom, what still shows, and how finished it is.

What is Ethereum’s zkAPI?

zkAPI is a way to pay for an online service, such as an AI model, without the payment being tied to your identity. The Foundation says the Open Anonymity Project built it with the Ethereum Foundation and that “it runs on Ethereum Mainnet today.” The Block describes the Open Anonymity Project as an open-source AI privacy effort.

The post was written by Vittorio Rivabella of the Foundation’s AI team, which it calls the dAI team. The design came earlier, in a February research post by Davide Crapis and Vitalik Buterin. The Block describes Crapis as the lead of the dAI team and Buterin as an Ethereum co-founder.

The research post opens with the problem: “A core challenge in API metering is achieving privacy, security, and efficiency simultaneously.” An API is the doorway one program uses to ask another for something. Metered means you pay per use. When you pay for a service that way today, your payment and your account sit together, so the company can tie what you asked to who you are. The Block says AI chat and AI agents are the first use, with image tools, internet privacy services and machine-to-machine payments also listed.

How does zkAPI work?

Per the Foundation’s post, it works in five steps:

1. You put money into a shared vault on Ethereum once. Your balance becomes what the post calls a private note. The post says the live vault holds credits in USDC, a dollar stablecoin; The Block says deposits can be tokens like ETH or USDC.
2. To pay, software on your device makes a zero-knowledge proof: a way to prove something is true without showing the details. Here it proves you have a funded note, without showing which one.
3. A zkAPI server checks the proof and hands you a short-lived key with a spending cap. The post says that key “exists only in your device’s memory.”
4. When the key expires, the post says the server charges your private balance for what you actually used, not the full cap.
5. To stop anyone spending the same balance twice, The Block says a double-spend attempt “exposes the attempt and nothing else.”

Think of a prepaid card. Buying the card is on the record. The design aims to keep what you spend it on from being tied back to the card. Zero-knowledge proofs have a longer history in crypto; we covered one famous early use in the Zcash trusted setup story.

What does zkAPI hide, and what still shows?

The Foundation’s post includes a table of what each party sees. Here is that table in plain terms, with the limits the post lists further down added in:

Party	Doesn’t learn (per the post)	Still sees (per the post)
zkAPI payment server	Who you are, what you asked, which deposit paid	That a valid payment exists, and total dollars per session; can link requests that come from the same IP address
AI provider	Who is paying	Your questions and its answers, your IP address; can re-link sessions if you repeat personal details or writing style
Public Ethereum chain	What any balance paid for	Deposits, closes and withdrawals
Relay in “proxy mode”	Not stated	Your traffic: “the relay sees traffic”

The idea is to split the picture so that, by design, no single party holds both your payment and your questions. But The Block puts the limit plainly: the system “does not provide network anonymity, according to the post.” Network anonymity means hiding where your connection comes from, and that is a separate job. Both sources say the post points to separate network tools, such as Tor, for that layer.

So if you type your name, city or job into a question, payment privacy can’t undo that.

Is zkAPI live, and is it audited?

It is live, and its own code page calls it experimental. The Foundation’s post links a mainnet vault contract, and Etherscan lists it as ZkApiVault with its source code verified. Verified source code means the published code matches what runs on chain. It is not the same as a security audit. The post also lists a test deployment on Sepolia, a practice network.

The project’s GitHub repository says: “The protocol is experimental.” The Block reports that too. None of the three main sources we read mention a security audit, so as far as reported, zkAPI is experimental and unaudited.

Ken Liu, a Stanford computer science PhD candidate who works on the Open Anonymity Project, told The Block: “It’s like a generalization of OA unlinkable inference that also abstracts payments away.” In plain terms, it takes their earlier idea of asking an AI without being tied to the question, and adds paying. The February research post set a goal to “deposit funds once and make thousands of API calls anonymously, securely, and efficiently.” That is a design goal, not a measured result.

What don’t the sources say?

The sources give no user numbers, no vault totals, no fees and no full list of AI companies that accept these keys. They say nothing about ETH’s price, and neither do we. We’d rather leave those gaps open than guess.

How could a reader misread zkAPI?

• Reading private payment as full anonymity, when the post says your IP address and questions still show.
• Forgetting that the deposit sits on the public chain.
• Treating an experimental tool with no reported audit as finished.
• Typing personal details into questions and expecting the payment layer to hide them.
• Treating payment privacy as a way around tax or reporting rules, which it isn’t.

The strongest case that zkAPI matters: the Foundation’s post and The Block agree on the core facts; the post lists its own limits next to its claims; the code is public; and the design comes from a public research post by named authors.

What should holders watch next?

1. Whether the project publishes a security audit.
2. Whether the repository drops the experimental label, and when.
3. Which AI companies say, on their own pages, that they accept these keys.

What would change our view: a published audit, or the project dropping the experimental label with a dated note.

Five checks for any crypto privacy claim

1. Name who it is hidden from. For zkAPI, the payment is hidden from the AI company, and your questions from the payment server, per the post.
2. Find the list of what still shows, such as your IP address and your questions.
3. Check what’s on the public chain, such as a deposit.
4. Check whether it’s marked experimental, and whether an audit is published.
5. Remember your own tax and reporting rules still apply, whatever the tool hides.

Private from someone isn’t the same as private from all sides. Here, the same post says you can pay without being known, and that the AI company still sees your questions and your IP address. Both lines are true, and you need both for the full picture.