Ethereum Foundation puts anonymous pay-per-call AI billing on mainnet with zkAPI

In credit terms, the zkAPI server lends. According to the Foundation's post, it authorises spending up to a cap before it settles, and it settles against a balance it has been shown is funded but cannot tie to a payer ^[2][5]. The payment layer never handles the work itself, because prompts go directly to the model provider ^[2]. A published serial number stops double-spending. "A user who tries to spend the same balance twice produces a duplicate nullifier, which exposes the attempt and nothing else," said the post, written by Vittorio Rivabella of the Foundation's dAI team ^[8][15].

The launch materials as reported do not include a fee, the rule linking a key's cap to the note behind it, or how the model provider receiving those prompts gets paid.

"Every AI API call today carries an identity," the post said. "Your API key points to an account, the account to a payment method, and every prompt you send joins the record attached to both." ^[9] zkAPI takes the account and the payment method out of that chain ^[5]. The prompt stays in it. The post concedes that sessions can still be re-linked through personal details, writing style or conversation history ^[7]. It also concedes that a gateway can correlate requests from a stable IP address, and it leaves that gap to Tor ^[6].

I see three ways this develops. In the first, it stays a tool for people who already route through Tor and keep small balances. In the second, a commercial model provider accepts the keys as a billing channel and brings ordinary chat users with it. In the third, the volume comes from software paying software, meaning the agent-to-agent and RPC uses on the post's list ^[11]. "It's like a generalization of OA unlinkable inference that also abstracts payments away," Ken Liu, a Stanford computer science PhD candidate who works on the Open Anonymity Project, said in an X post ^[16].

I'd expect the third path to produce volume first. An RPC query or a payment between two agents carries little of the personal detail, writing style or conversation history that the post says can re-link sessions ^[7]. That avoids one of the two limits the post names. The other limit is the counter-case: an agent running from a fixed server address is exactly the stable-IP correlation the post describes ^[6]. If the vault holds little ETH or USDC six months from now ^[1], none of the three paths has started and the view is wrong.