What is Ethereum zkAPI? Anonymous AI payments with a missing authorization layer

On October 1, 2026, the Ethereum Foundation and the Open Anonymity Project launched zkAPI — live on Ethereum mainnet. Deposit ETH or USDC into a vault, sign a zero-knowledge proof, and get a temporary API key with a predetermined spending cap — then pay for AI models and metered APIs without revealing who you are. "Every AI API call today carries an identity," the announcement post said. "Your API key points to an account, the account to a payment method, and every prompt you send joins the record attached to both." Every outlet in the October 1–2 field answers how the privacy works. None answers the question that decides whether anonymous machine payments can survive the audit age: a zero-knowledge proof proves the payment is backed — it says nothing about whether the payment should have fired. The machine-native answer is the decision gate: ≥0.80 auto-act, 0.50–0.79 human confirm, <0.50 block, log, and escalate.

What actually launched (receipts, dated)

What the field lacks (every one of them)

The October 1–2 field is launch coverage: The Block, ForkLog, KuCoin, COINOTAG, W3Rooster, Blockonomi. Zero per-payment authorization modeling. Zero analysis of what anonymity does to every identity-based authorization scheme. Zero code for scoring a payment instruction before it fires. And zero connection to the September authorization arc — the six banks' audit demand (Sept 22), the FTC's industry-wide rogue-agent probe (announced Sept 30, covering Anthropic, OpenAI, and METR), the $78,000 OpenAI Codex runaway (Sept 26, our breakdown), and the six-guard ecosystem week (our Sept 30 spending-guard piece). zkAPI landed in a world demanding auditable records of instruction, authority, intent, and outcome — and it anonymizes authority.

The gate mapping: proof is not permission

The design thesis: when nobody knows who paid, the only question left is whether the payment was wise. The decision gate answers it per-payment, not per-identity: score the instruction's confidence, act on the band — ≥0.80 auto-act, 0.50–0.79 human confirm, <0.50 block, log, escalate — and keep the gate record (instruction, confidence, band, outcome, timestamp) as the auditable artifact. That record is the machine-native version of what the banks demanded: auditable instruction/authority/intent/outcome without identity. And the honest tension stands: the FTC's rogue-agent probe and the banks' audit demand point toward attribution; zkAPI points away from it. The gate doesn't resolve that legal tension — it bounds the practical one: the pattern we plant our flag on.

Live gate receipts (minted today, not hypotheticals)

Scored against the live endpoint POST https://scriptmasterlabs.com/api/harness/decide — local-heuristic-v1, gate bands 0.80/0.50 live on the endpoint, October 2, 2026 ~14:35 EDT. Exact shape: {"state": {...}, "questions":[{"id","type":"score","scale":[0,1],"question"}]}.

Honest finding: the uncalibrated heuristic escalates both — it cannot discriminate the routine capped spend from the vault-drain attack (fifth run in a row with this finding: seatbelt, XRPL, Sigo, Robinhood, now zkAPI). The "anonymous" phrasing pushes every score down; fail-closed is the protection. This is also the piece's kicker: inside zkAPI, even the human can't audit who — the gate is the only instrument that still asks whether the payment itself was wise. Receipts: zkapi-1 → value 0.087, confidence 0.4022; zkapi-2 → value 0, confidence 0.35. Meta: decider local-heuristic-v1, calibrated=false, typesafe_wired=false. The calibrated decider upgrade is the open-weights Jev-27B family (our Oct 1 piece) — calibrated probabilities are exactly the input this gate was designed to consume.

Do it yourself: gate an anonymous machine spend in 5 steps

1. Fix the ceiling first. zkAPI's temporary keys already cap spend per key — treat that cap as the outer container, not the decision. Set it at the lowest value that survives a workday.
2. Score before every spend. Pipe each agent payment instruction through a scored decision first:

   curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
     -H "Content-Type: application/json" \
     -d '{"state":{"vault":"zkapi"},"questions":[{"id":"p1","type":"score","scale":[0,1],
         "question":"Should the agent spend 0.05 ETH of zkAPI vault funds on an anonymous inference call?"}]}'

3. Act on the band, not the identity. ≥0.80 → auto-act (the key fires); 0.50–0.79 → hold for human confirm; <0.50 → block, log, escalate. Never approve on "funded vault" alone.
4. Keep the gate record, not the identity. Log instruction, confidence, band, outcome, timestamp per payment — the nullifier proves no double-spend; the gate record proves the spend was judged. Both survive anonymity.
5. Record consent like it has a statute of limitations. High-value or unfamiliar payees halt until a person signs off — the Legal Context Protocol pattern (our Sept 24 piece).

Claim Receipts

Honest caveats

• Coverage is press-reporting based (The Block, ForkLog, Blockonomi, KuCoin, COINOTAG, W3Rooster), not hands-on — no independent vault-contract verification; the "ZkApiVault" contract name appeared in one outlet and is not claimed here.
• The protocol is self-labeled experimental; the February proposal is "ZK API Usage Credits" per outlet summaries — primary proposal text not independently verified.
• Gate receipts are from local-heuristic-v1 (uncalibrated, calibrated=false, typesafe_wired=false) — an instrument demo, not a production decider.
• The privacy-vs-audit tension is real and unresolved: gate records don't fix the legal question of attribution; they bound the practical question of judgment.

Related: Decision-gated machine payments · The x402 spending-guard ecosystem · The $78,000 OpenAI Codex incident · The Legal Context Protocol · FTC AI agent liability · Should AI agents authorize payments? · JEV-27B open decision model · AI agent payment authorization

Published Oct 2, 2026 by ScriptMasterLabs — scriptmasterlabs.com