Full article
Why billing and activity become linked
The Ethereum Foundation introduced zkAPI on October 1, 2026 as a way to reduce the connection between API usage and payment identity. The underlying issue is linkage, not simply whether a form contains a real name. Consider two hypothetical work sessions attached to one persistent account. Charging different amounts does not stop the service from treating them as activity by the same account holder. A billing design can therefore reveal relationships across tasks even when any individual payment seems unremarkable. Separating those relationships is the motivating privacy problem.
Prove spending capacity without identifying the deposit
The described design starts with deposited credits and uses zero-knowledge proofs to authorize spending. Conceptually, the verifier receives an answer to a narrow question: whether the proposed payment is backed by sufficient, unspent value. It need not receive every piece of information associated with that value. Removing a name field would be a weaker change if a persistent account still acted as the identifier. The important distinction is the relationship revealed by verification. Equally, a narrowly scoped proof can protect only the information within its scope; it is not an all-purpose privacy layer.
A spending limit differs from the final bill
The design issues short-lived keys with spending caps and settles actual metered use. Imagine authorizing a maximum budget of ten units and consuming three. Ten represents the permitted exposure for the session; three represents the usage in this hypothetical example. An interface should not collapse both into an unexplained balance deduction. Otherwise, a temporary reservation can look like a final charge. This also distinguishes two controls: limiting how much can be spent and checking whether usage was measured correctly. A sensible cap cannot, on its own, establish that a particular bill is accurate.
Payment privacy does not conceal request content
Suppose a request includes a company name and a detailed description of its confidential project. Hiding the funding relationship does not remove those words from the service’s input. Timing, network information, and repeated content may also provide clues about related sessions. The source distinguishes a direct runtime-key path from a proxy arrangement in which the relay handles traffic. The practical analysis must therefore trace the actual information path. A feature protecting one relationship should not be generalized into a claim that every participant is unable to identify or correlate the person using the service.
Verifiable payment still needs understandable boundaries
Our interpretation is that the useful product principle is limited authority for a specific task: limited budget, limited duration, and limited disclosure. Users still need understandable answers about expiration, usage accounting, and what happens to reserved capacity after interruption. Those are service and settlement questions that do not disappear merely because a cryptographic proof verifies. This article explains the design presented in October rather than claiming identical support across all APIs or later software versions. Its strongest promise concerns separation of payment relationships; other privacy and reliability properties require their own analysis.