Introducing zkAPI: private usage credits for any API

tl;dr: zkAPI helps you to pay for a metered API with out being identified. Deposit credit into an Ethereum vault as soon as, then authorize bounded utilization with zero-knowledge proofs as a substitute of an identification. The supplier sees the requests, and the fee layer sees the spend. Neither learns the hyperlink between them.

The Open Anonymity Venture constructed it with the Ethereum Basis, and it runs on Ethereum Mainnet immediately.

The issue

Each AI API name immediately carries an identification. Your API key factors to an account, the account to a fee technique, and each immediate you ship joins the document connected to each. The supplier can join years of your utilization right into a single profile.

Prompts are private. Folks ask AI fashions about their well being, their funds, their doubts. Underneath the present mannequin, utilizing AI means handing a working transcript of your considering to whoever holds the billing relationship. The alternate options have been poor: pay per request onchain, which is gradual, costly, and traceable by anybody, or belief a intermediary to not look.

The concept

zkAPI separates fee from identification. You deposit credit (ETH, USDC, and so forth.) right into a vault contract on Ethereum, one abnormal transaction. From then on, your steadiness exists as a personal be aware: digital money that solely you may spend and that no person can hint again to the deposit.

To authorize spending, software program in your machine produces a small zero-knowledge proof that claims, in impact, {that a} funded be aware covers this spend and no person has spent it earlier than. One proof can cowl a single request or a complete session. The server can examine that the assertion is true with out studying which be aware, which deposit, or which individual. On the fee layer, requests don’t hyperlink to you, and they don’t hyperlink to one another.

Two items of cryptography make this protected in addition to non-public. Deposits dwell as commitments in a Merkle tree, so a proof can present “my be aware is likely one of the legitimate ones” with out pointing at any explicit one. Each spend publishes a nullifier, a one-way serial quantity derived from the be aware’s secret. A consumer who stays inside their steadiness stays unlinkable. A consumer who tries to spend the identical steadiness twice produces a reproduction nullifier, which exposes the try and nothing else.

The way it works

The fee path (steps 1 to three) and the dialog path (step 4) share two objects: the short-lived key and its utilization receipt.

The server that handles cash by no means sees content material, and the supplier that sees content material by no means learns the billing identification behind a key.

Your app talks to a small consumer working by yourself system. Nothing in regards to the app adjustments. It speaks the identical API it at all times did.The consumer sends the zkAPI server a proof of fee, with no immediate and no identification connected.The server checks the proof and mints a recent API key on the spot, short-lived and capped in {dollars}. The important thing exists solely in your system’s reminiscence.Your prompts go straight out of your system to the AI supplier with that key. When the important thing expires, the server expenses your non-public steadiness for the metered utilization fairly than the reserved cap.

The spending cap works as a reservation. When the important thing expires, the supplier aspect information the important thing’s whole utilization in a signed receipt, and the server deducts that quantity out of your be aware. Neither aspect can rewrite the invoice afterward, and one authorization covers a complete session of requests fairly than one proof per name.

zkAPI additionally ships a less complicated proxy mode, the place the zkAPI server relays requests to the supplier itself. It’s simpler to function, however the relay sees site visitors. The runtime-key mode above exists in order that no fee middleman ever does.

zkAPI proves spends with Groth16 on the BN254 curve, hashes commitments and nullifiers with Poseidon, and retains notes in a Merkle tree 32 ranges deep. The server verifies spend proofs off-chain. The vault contract verifies the identical sort of proof at deposit, shut, and escape, so your exit by no means is dependent upon the server’s honesty.

In follow

PartyLearnsNever learnszkAPI servera legitimate fee exists, and whole {dollars} per sessionwho you might be, what you requested, which deposit paidAI providerprompts and responses, because it runs the modelwho is payingEthereum (public)deposits, closes, withdrawalswhat any steadiness paid for

Your funds keep yours: The vault is a contract on Ethereum fairly than an organization account: you may shut your steadiness and withdraw onchain, even when each zkAPI server disappears.

Your instruments keep the identical: The consumer exposes the usual OpenAI and Ollama APIs by yourself machine. Present apps, editors, and chat purchasers work by pointing them at localhost.

Use circumstances

AI inference comes first as a result of prompts are delicate and the billing path ties every one to you. The identical consumer and contracts can entrance any service that expenses per use:

Use caseMetered unitWhat the fee layer hidesAI chat and agentsmodel callswhich be aware paid, and any billing hyperlink between sessionsBlockchain RPCquerieswhich funding supply paid for the queriesImage and video generationjobswho paid for which jobsVPNs and bandwidthtime and datawho paid for the connectionMachine-to-machine servicesper-task spendagents pay with out an account

zkAPI hides the fee hyperlink. A supplier nonetheless sees what a request incorporates and community metadata corresponding to your IP handle, and it will possibly attempt to correlate classes by timing. Community anonymity and content material privateness are separate layers: a VPN or Tor handles the community aspect, and confidential GPU computing is rising for content material.

For suppliers, integrating means accepting a proof as a substitute of an API key and settling signed utilization receipts as a substitute of sustaining accounts. Pricing, charge limits, and infrastructure keep as they’re.

Limitations

zkAPI’s protections have two limitations: the shortage of community anonymity, and privateness leakage by way of immediate contents.

On the community aspect, the primary subject is that the gateway can probably correlate request patterns from a consumer in the event that they ship requests to zkAPI underneath a steady consumer IP handle. Customers in search of stronger privateness might route requests via Tor and use a recent circuit for every session.

On the content material aspect, particular person classes could also be re-linked by the inference supplier if the identical private particulars, writing model, reused dialog historical past, or venture paperwork are offered. Shared immediate contents can act as fingerprints for anybody who can learn the prompts. It is a privacy-utility tradeoff: standalone queries are extra non-public however much less helpful since previous context is lacking. One mitigation is to leverage native or TEE fashions to generate requests on high of shared reminiscence as a substitute of the consumer manually writing them. See additionally discussions within the Open Anonymity venture submit.