tl;dr: zkAPI permits you to pay for a metered API with out being identified. Deposit credits into an Ethereum vault as soon as, then authorize bounded usage with zero-knowledge proofs as a substitute of an identification. The supplier sees the requests, and the cost layer sees the spend. Neither learns the hyperlink between them.
The Open Anonymity Project constructed it with the Ethereum Basis, and it runs on Ethereum Mainnet at this time.
The issue
Each AI API name at this time carries an identification. Your API key factors to an account, the account to a cost methodology, and each immediate you ship joins the document hooked up to each. The supplier can join years of your usage right into a single profile.
Prompts are private. Folks ask AI fashions about their well being, their funds, their doubts. Underneath the present mannequin, utilizing AI means handing a working transcript of your pondering to whoever holds the billing relationship. The alternate options have been poor: pay per request onchain, which is gradual, costly, and traceable by anybody, or belief a intermediary to not look.
The thought
zkAPI separates cost from identification. You deposit credits (ETH, USDC, and so forth.) right into a vault contract on Ethereum, one abnormal transaction. From then on, your steadiness exists as a private word: digital money that solely you may spend and that no one can hint again to the deposit.
To authorize spending, software program in your machine produces a small zero-knowledge proof that claims, in impact, {that a} funded word covers this spend and no one has spent it earlier than. One proof can cowl a single request or an entire session. The server can test that the assertion is true with out studying which word, which deposit, or which particular person. On the cost layer, requests don’t hyperlink to you, and they don’t hyperlink to one another.
Two items of cryptography make this secure in addition to private. Deposits dwell as commitments in a Merkle tree, so a proof can present “my word is likely one of the legitimate ones” with out pointing at any specific one. Each spend publishes a nullifier, a one-way serial quantity derived from the word’s secret. A consumer who stays inside their steadiness stays unlinkable. A consumer who tries to spend the identical steadiness twice produces a reproduction nullifier, which exposes the try and nothing else.
The way it works
The cost path (steps 1 to three) and the dialog path (step 4) share two objects: the short-lived key and its usage receipt.
The server that handles cash by no means sees content material, and the supplier that sees content material by no means learns the billing identification behind a key.
- Your app talks to a small shopper working by yourself system. Nothing in regards to the app modifications. It speaks the identical API it all the time did.
- The shopper sends the zkAPI server a proof of cost, with no immediate and no identification hooked up.
- The server checks the proof and mints a contemporary API key on the spot, short-lived and capped in {dollars}. The important thing exists solely in your system’s reminiscence.
- Your prompts go straight out of your system to the AI supplier with that key. When the important thing expires, the server prices your private steadiness for the metered usage reasonably than the reserved cap.
The spending cap works as a reservation. When the important thing expires, the supplier aspect data the important thing’s whole usage in a signed receipt, and the server deducts that quantity out of your word. Neither aspect can rewrite the invoice afterward, and one authorization covers an entire session of requests reasonably than one proof per name.
zkAPI additionally ships a less complicated proxy mode, the place the zkAPI server relays requests to the supplier itself. It’s simpler to function, however the relay sees visitors. The runtime-key mode above exists in order that no cost middleman ever does.
zkAPI proves spends with Groth16 on the BN254 curve, hashes commitments and nullifiers with Poseidon, and retains notes in a Merkle tree 32 ranges deep. The server verifies spend proofs off-chain. The vault contract verifies the identical form of proof at deposit, shut, and escape, so your exit by no means is dependent upon the server’s honesty.
In follow
| Occasion | Learns | By no means learns |
|---|---|---|
| zkAPI server | a legitimate cost exists, and whole {dollars} per session | who you’re, what you requested, which deposit paid |
| AI supplier | prompts and responses, because it runs the mannequin | who’s paying |
| Ethereum (public) | deposits, closes, withdrawals | what any steadiness paid for |
-
Your funds keep yours: The vault is a contract on Ethereum reasonably than an organization account: you may shut your steadiness and withdraw onchain, even when each zkAPI server disappears.
-
Your instruments keep the identical: The shopper exposes the usual OpenAI and Ollama APIs by yourself machine. Present apps, editors, and chat shoppers work by pointing them at localhost.
Use circumstances
AI inference comes first as a result of prompts are delicate and the billing path ties each to you. The identical shopper and contracts can entrance any service that prices per use:
| Use case | Metered unit | What the cost layer hides |
|---|---|---|
| AI chat and brokers | mannequin calls | which word paid, and any billing hyperlink between periods |
| Blockchain RPC | queries | which funding supply paid for the queries |
| Picture and video era | jobs | who paid for which jobs |
| VPNs and bandwidth | time and knowledge | who paid for the connection |
| Machine-to-machine companies | per-task spend | brokers pay with out an account |
zkAPI hides the cost hyperlink. A supplier nonetheless sees what a request comprises and community metadata corresponding to your IP tackle, and it could actually attempt to correlate periods by timing. Community anonymity and content material privateness are separate layers: a VPN or Tor handles the community aspect, and confidential GPU computing is rising for content material.
For suppliers, integrating means accepting a proof as a substitute of an API key and settling signed usage receipts as a substitute of sustaining accounts. Pricing, price limits, and infrastructure keep as they’re.
Limitations
zkAPI’s protections have two limitations: the shortage of community anonymity, and privateness leakage through immediate contents.
On the community aspect, the principle concern is that the gateway can probably correlate request patterns from a consumer in the event that they ship requests to zkAPI underneath a steady consumer IP tackle. Customers in search of stronger privateness could route requests via Tor and use a contemporary circuit for every session.
On the content material aspect, particular person periods could also be re-linked by the inference supplier if the identical private particulars, writing model, reused dialog historical past, or challenge paperwork are offered. Shared immediate contents can act as fingerprints for anybody who can learn the prompts. This can be a privacy-utility tradeoff: standalone queries are extra private however much less helpful since previous context is lacking. One mitigation is to leverage native or TEE fashions to generate requests on prime of shared reminiscence as a substitute of the consumer manually writing them. See additionally discussions within the Open Anonymity project post.
Background and hyperlinks
zkAPI is the working implementation of ZK API usage credits, a design revealed on Ethereum Analysis by Davide Crapis and Vitalik Buterin.
The Open Anonymity crew helped flip that design into the shopper, the server, and the contracts you may run at this time.
zkAPI is dwell on Ethereum mainnet at this time. Attempt it:
Or build the local gateway and level any OpenAI-compatible app at it utilizing the docs.
