zkAPI hides payment links, so why study request contents?
In its October 1, 2026 introduction to zkAPI, the Ethereum Foundation described an approach that separates payments from identity: users deposit a usage allowance, then use zero-knowledge proofs to authorize limited usage. This article examines the scope of the design described in that material; it does not extend the claims to say that all use cases are completely anonymous.
The introduction distinguishes between the payment path and the request path. In runtime-key mode, the payment service verifies a proof and issues a short-lived, limited-use key, while the user's device sends requests directly to the provider. The payment intermediary therefore does not need to access request contents.
But the provider still needs to process requests. The original text explicitly notes that it can see the content and network metadata such as IP addresses, and may be able to link sessions based on timing or repeated content. Hiding the source of funds and hiding what was asked are different privacy goals.
The mode also affects information flows. The article also describes a simpler proxy mode, in which a relay forwards requests and can therefore see the traffic. When discussing privacy, first establish which path is being used; an explanation of one mode should not be applied directly to another.
My research assessment is that these kinds of crypto payment tools can be evaluated by listing, separately, who handles payments, who receives content, and who retains usage credentials. Privacy capabilities should be tied to specific information and participants; the term “zero-knowledge proof” is no substitute for a complete analysis of data flows.
This article has not verified transaction volumes, fees, or independent security audits for current deployments, nor does it claim that any particular service is free of linkage risks. Further research should begin with clearly specified operating modes and readable documentation.
Original introduction: https://blog.ethereum.org/2026/10/01/introducing-zkapi
In its October 1, 2026 introduction to zkAPI, the Ethereum Foundation described an approach that separates payments from identity: users deposit a usage allowance, then use zero-knowledge proofs to authorize limited usage. This article examines the scope of the design described in that material; it does not extend the claims to say that all use cases are completely anonymous.
The introduction distinguishes between the payment path and the request path. In runtime-key mode, the payment service verifies a proof and issues a short-lived, limited-use key, while the user's device sends requests directly to the provider. The payment intermediary therefore does not need to access request contents.
But the provider still needs to process requests. The original text explicitly notes that it can see the content and network metadata such as IP addresses, and may be able to link sessions based on timing or repeated content. Hiding the source of funds and hiding what was asked are different privacy goals.
The mode also affects information flows. The article also describes a simpler proxy mode, in which a relay forwards requests and can therefore see the traffic. When discussing privacy, first establish which path is being used; an explanation of one mode should not be applied directly to another.
My research assessment is that these kinds of crypto payment tools can be evaluated by listing, separately, who handles payments, who receives content, and who retains usage credentials. Privacy capabilities should be tied to specific information and participants; the term “zero-knowledge proof” is no substitute for a complete analysis of data flows.
This article has not verified transaction volumes, fees, or independent security audits for current deployments, nor does it claim that any particular service is free of linkage risks. Further research should begin with clearly specified operating modes and readable documentation.
Original introduction: https://blog.ethereum.org/2026/10/01/introducing-zkapi