Does ZAK work with anonymous join exception?

Meeting SDK Android
1

Environment:

Android MobileRTC SDK (local mobilertc.aar)
Marketplace app type: Server-to-Server OAuth
Account/App setting: Production → Embed → “Request Anonymous Join Exception” is enabled (ON)

Context:
Our account has Anonymous Join Exception enabled, so devices can currently join meetings without any ZAK/OBF, purely anonymously. Per updated internal security policy, we want devices to instead join as authenticated participants, vouched for by a licensed account (info@…, the owner of our Server-to-Server OAuth app), using a ZAK for that account — the device still joins as a normal participant, not host. This is purely a security/compliance measure, not about meeting control privileges.

What we did:

JoinMeetingParam4WithoutLogin param4WithoutLogin = new JoinMeetingParam4WithoutLogin();
param4WithoutLogin.meetingNo = zoomData.getZoom_meeting_no();
param4WithoutLogin.displayName = EventRepo.userData.getLocation();
param4WithoutLogin.password = zoomData.getZoom_password();
param4WithoutLogin.zoomAccessToken = zoomZakToken; // ZAK for info@..., fetched from our backend per device

meetingService.joinMeetingWithParams(hf24ZoomContext, param4WithoutLogin, opts);

JoinMeetingParam4WithoutLogin also exposes userType (int) and onBehalfToken (String), which we left unset/default — we only populated zoomAccessToken.

Problem:
Regardless of what we put in zoomAccessToken — a real ZAK for info@… fetched right before joining, a random/garbage string, an empty string, or leaving it unset — the join behaves identically (device joins fine as a participant either way). We can’t tell whether the ZAK is actually being validated/consumed, or simply ignored because Anonymous Join Exception already permits the join unconditionally.

Questions:

When “Request Anonymous Join Exception” is ON for the account, does the join backend even evaluate zoomAccessToken at all — or is it skipped entirely since anonymous join is already unconditionally allowed? If so, is there any way to make ZAK validation happen (fail the join on an invalid ZAK) even while the exception is enabled, so we can be sure it’s actually wired in?

Does zoomAccessToken on JoinMeetingParam4WithoutLogin require userType and/or onBehalfToken to be set for it to be evaluated at all? Docs we found don’t specify valid values for userType in this context.

We cannot turn off the Anonymous Join Exception to test this, since our use case requires testing directly on production. Is there any other way to verify client-side (or via Zoom dashboard/logs) whether a given join actually validated the ZAK — e.g., a callback, error code, or meeting/account log entry that distinguishes “ZAK checked and accepted”, “ZAK checked and rejected”, vs. “ZAK not evaluated at all”?

3

I think there are two possible explanations here: either the backend completely ignores the ZAK, or it does check ZAK validity — using it to join if valid, and silently falling back to anonymous join if invalid.

One caveat on my side: when I said “valid token,” that was just a token I fetched from the API (/v2/users/{userId}/token?type=zak) — I have no independent way to confirm it was actually accepted as valid, since the join succeeds regardless of what token (or no token) is passed, and there’s no log or response field that distinguishes which path was taken.

Have you managed to figure out which of these it actually is?