Introducing zkAPI: private usage credits for any API

tl;dr: zkAPI lets you wage for a metered API without being known. Deposit credits into an Ethereum vault once, past authorize bounded usage with zero-knowledge proofs alternatively of an identity. The supplier sees the requests, and the outgo furniture sees the spend. Neither learns the nexus betwixt them.

The Open Anonymity Project built it with the Ethereum Foundation, and it runs connected Ethereum Mainnet today.

The problem

Every AI API telephone contiguous carries an identity. Your API cardinal points to an account, the relationship to a outgo method, and each punctual you nonstop joins the grounds attached to both. The supplier tin link years of your usage into a azygous profile.

Prompts are personal. People inquire AI models astir their health, their finances, their doubts. Under the existent model, utilizing AI means handing a moving transcript of your reasoning to whoever holds the billing relationship. The alternatives were poor: wage per petition onchain, which is slow, expensive, and traceable by anyone, oregon spot a middleman not to look.

The idea

zkAPI separates outgo from identity. You deposit credits (ETH, USDC, etc.) into a vault declaration connected Ethereum, 1 mean transaction. From past on, your equilibrium exists arsenic a backstage note: integer currency that lone you tin walk and that cipher tin hint backmost to the deposit.

To authorize spending, bundle connected your instrumentality produces a tiny zero-knowledge impervious that says, successful effect, that a funded enactment covers this walk and cipher has spent it before. One impervious tin screen a azygous petition oregon a full session. The server tin cheque that the connection is existent without learning which note, which deposit, oregon which person. At the outgo layer, requests bash not nexus to you, and they bash not nexus to each other.

Two pieces of cryptography marque this harmless arsenic good arsenic private. Deposits unrecorded arsenic commitments successful a Merkle tree, truthful a impervious tin amusement “my enactment is 1 of the valid ones” without pointing astatine immoderate peculiar one. Every walk publishes a nullifier, a one-way serial fig derived from the note's secret. A idiosyncratic who stays wrong their equilibrium stays unlinkable. A idiosyncratic who tries to walk the aforesaid equilibrium doubly produces a duplicate nullifier, which exposes the effort and thing else.

How it works

The outgo way (steps 1 to 3) and the speech way (step 4) stock 2 objects: the short-lived cardinal and its usage receipt.

The server that handles wealth ne'er sees content, and the supplier that sees contented ne'er learns the billing individuality down a key.

1. Your app talks to a tiny lawsuit moving connected your ain device. Nothing astir the app changes. It speaks the aforesaid API it ever did.
2. The lawsuit sends the zkAPI server a impervious of payment, with nary punctual and nary individuality attached.
3. The server checks the impervious and mints a caller API cardinal connected the spot, short-lived and capped successful dollars. The cardinal exists lone successful your device's memory.
4. Your prompts spell consecutive from your instrumentality to the AI supplier with that key. When the cardinal expires, the server charges your backstage equilibrium for the metered usage alternatively than the reserved cap.

The spending headdress works arsenic a reservation. When the cardinal expires, the supplier broadside records the key's full usage successful a signed receipt, and the server deducts that magnitude from your note. Neither broadside tin rewrite the measure afterward, and 1 authorization covers a full league of requests alternatively than 1 impervious per call.

zkAPI besides ships a simpler proxy mode, wherever the zkAPI server relays requests to the supplier itself. It is easier to operate, but the relay sees traffic. The runtime-key mode supra exists truthful that nary outgo intermediary ever does.

zkAPI proves spends with Groth16 connected the BN254 curve, hashes commitments and nullifiers with Poseidon, and keeps notes successful a Merkle histrion 32 levels deep. The server verifies walk proofs off-chain. The vault declaration verifies the aforesaid benignant of impervious astatine deposit, close, and escape, truthful your exit ne'er depends connected the server’s honesty.

In practice

• Your funds enactment yours: The vault is simply a declaration connected Ethereum alternatively than a institution account: you tin adjacent your equilibrium and retreat onchain, adjacent if each zkAPI server disappears.

• Your tools enactment the same: The lawsuit exposes the modular OpenAI and Ollama APIs connected your ain machine. Existing apps, editors, and chat clients enactment by pointing them astatine localhost.

Use cases

AI inference comes archetypal due to the fact that prompts are delicate and the billing way ties each 1 to you. The aforesaid lawsuit and contracts tin beforehand immoderate work that charges per use:

zkAPI hides the outgo link. A supplier inactive sees what a petition contains and web metadata specified arsenic your IP address, and it tin effort to correlate sessions by timing. Network anonymity and contented privateness are abstracted layers: a VPN oregon Tor handles the web side, and confidential GPU computing is emerging for content.

For providers, integrating means accepting a impervious alternatively of an API cardinal and settling signed usage receipts alternatively of maintaining accounts. Pricing, complaint limits, and infrastructure enactment arsenic they are.

Limitations

zkAPI’s protections person 2 limitations: the deficiency of web anonymity, and privateness leakage via punctual contents.

On the web side, the main contented is that the gateway tin perchance correlate petition patterns from a idiosyncratic if they nonstop requests to zkAPI nether a unchangeable idiosyncratic IP address. Users seeking stronger privateness whitethorn way requests done Tor and usage a caller circuit for each session.

On the contented side, idiosyncratic sessions whitethorn beryllium re-linked by the inference supplier if the aforesaid idiosyncratic details, penning style, reused speech history, oregon task documents are presented. Shared punctual contents tin enactment arsenic fingerprints for anyone who tin work the prompts. This is simply a privacy-utility tradeoff: standalone queries are much backstage but little utile since past discourse is missing. One mitigation is to leverage section oregon TEE models to make requests connected apical of shared representation alternatively of the idiosyncratic manually penning them. See besides discussions successful the Open Anonymity project post.

Background and links

zkAPI is the moving implementation of ZK API usage credits, a plan published connected Ethereum Research by Davide Crapis and Vitalik Buterin.

The Open Anonymity squad helped crook that plan into the client, the server, and the contracts you tin tally today.

zkAPI is unrecorded connected Ethereum mainnet today. Try it:

• zkAPI GitHub Repository: the section client, server, and browser SDK
• zkAPI protocol: circuits, impervious code, and the vault contracts
• ZkApiVault connected Ethereum mainnet: the unrecorded vault, holding USDC credits
• Sepolia trial deployment: the aforesaid contracts with trial funds
• OA Chat: backstage AI chat successful the browser, nary install

Or build the section gateway and constituent immoderate OpenAI-compatible app astatine it utilizing the docs.