Skip to main content
WebCraft Kit
Mobile & Apps Essential

Deep Link, Apple Universal Links (AASA) & Android AssetLinks Studio

Interactive deep link builder and verification studio. Generates strict RFC compliant apple-app-site-association (AASA) and Android assetlinks.json files with SHA-256 fingerprint validation and live QR test triggers.

Universal Link & App Link Generator: Creates standard apple-app-site-association (AASA) and .well-known/assetlinks.json configuration files
Strict Schema & SHA-256 Verification: Validates Apple Team IDs, Bundle Identifiers, Package Names, and keystore SHA-256 certificate fingerprints
Path Pattern & Query Routing Builder: Configure wildcard matching (*, ?), regex paths, excluded paths, and deep link query parameters
Native Manifest & Info.plist Generator: Generates ready-to-paste Android AndroidManifest.xml <intent-filter> blocks and iOS Info.plist CFBundleURLTypes
Interactive QR Code Test Harness: Generates instant scan-to-test QR codes for live mobile device testing of custom schemes and HTTPS routes
100% Client-Side Privacy: All domain validation, fingerprint hashing checks, and file generation occur securely in your browser with zero data logging
WebCraftKit Manifesto 100% Client-Side Engine

Air-Gapped Privacy & Zero-Latency Developer Utilities

Every cryptographic algorithm, schema transformer, color space converter, and binary extractor runs entirely in your browser RAM. Your tokens, API secrets, and source code are never sent to external servers.

Zero Server Telemetry
•
Sub-Millisecond Execution
•
70 Production Tools
Read Architecture Story →
Comprehensive Technical Manual

The Complete Deep Linking Guide: Universal Links, Android App Links, and URL Schemes

In-depth specifications, architectural mechanics, real-world code implementations, and industry best practices.

01

The Modern Deep Linking Architecture: Custom Schemes vs Universal Links vs App Links

Mobile deep linking enables seamless routing from external websites, emails, or push notifications directly to specific in-app views. Traditional custom URL schemes (e.g., myapp://product/123) suffer from major security flaws: any malicious app installed on a device can register the identical scheme and intercept sensitive authentication tokens (scheme hijacking). To eliminate this vulnerability, Apple created Universal Links (iOS 9+) and Google created Android App Links (Android 6.0+). Both use standard HTTPS URLs backed by two-way cryptographic verification between the registered web domain and the native application.

Implementation Example 
// 1. Apple App Site Association (apple-app-site-association)
{
  "applinks": {
    "apps": [],
    "details": [
      {
        "appIDs": ["9JA89QQLNQ.com.example.myapp"],
        "components": [
          { "/": "/products/*", "comment": "Match all product pages" },
          { "/": "/auth/*", "exclude": true, "comment": "Do not deep link auth routes" }
        ]
      }
    ]
  }
}

// 2. Android Digital Asset Links (assetlinks.json)
[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.myapp",
      "sha256_cert_fingerprints": [
        "14:6D:E9:7C:F5:0A:D7:2F:3E:86:4F:9E:2B:1A:5C:3D:4E:6F:7A:8B:9C:0D:1E:2F:3A:4B:5C:6D:7E:8F:90:12"
      ]
    }
  }
]
02

Server Hosting Requirements and Verification Mechanics

For Apple Universal Links to function, your domain must host the apple-app-site-association file at https://<domain>/.well-known/apple-app-site-association (or root https://<domain>/apple-app-site-association). The endpoint must: 1) be served over HTTPS with a valid certificate, 2) have Content-Type: application/json, 3) not follow any HTTP redirects (301/302), and 4) be under 128KB. For Android App Links, the file must be served at https://<domain>/.well-known/assetlinks.json with Content-Type: application/json and return an HTTP 200 status code.

Implementation Example 
# NGINX server block for serving Universal Link & App Link verification files
location /.well-known/apple-app-site-association {
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    alias /var/www/mywebsite/.well-known/apple-app-site-association;
}

location /.well-known/assetlinks.json {
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    alias /var/www/mywebsite/.well-known/assetlinks.json;
}
03

Step-by-Step: Implementing Universal Links & App Links from Domain to Mobile App

Step 1: Enter your registered web domain (e.g., example.com), Apple Team ID (from developer.apple.com Membership), Bundle Identifier (com.example.app), Android Package Name, and release Keystore SHA-256 fingerprint. Step 2: Build path matching rules including wildcards (/items/*) and exclusions (/login*). Step 3: Copy generated apple-app-site-association and assetlinks.json files and upload them to your web server under /.well-known/. Step 4: In Xcode, add the Associated Domains capability with applinks:example.com. In Android Studio, add the <intent-filter android:autoVerify="true"> block to your AndroidManifest.xml. Step 5: Test links by scanning the live QR code or executing terminal ADB / xcrun commands.

Implementation Example 
<!-- Android AndroidManifest.xml intent-filter for Android App Links -->
<activity android:name=".MainActivity" android:exported="true">
    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:scheme="https" android:host="example.com" android:pathPrefix="/products" />
    </intent-filter>
</activity>
04

Handling Inbound Deep Links in SwiftUI, Jetpack Compose, Flutter & React Native

Once operating system verification succeeds, incoming URLs are passed directly to your app lifecycle handler. Applications should extract the URL path components and query parameters to dispatch state navigation to the designated screen.

Implementation Example 
// 1. SwiftUI (iOS)
@main
struct MyApp: App {
    var body: some Scene {
        WindowGroup {
            ContentView()
                .onOpenURL { url in
                    print("Received Universal Link: \(url.absoluteString)")
                    NavigationRouter.shared.handle(url: url)
                }
        }
    }
}

// 2. Android Kotlin (Jetpack Compose / Activity)
override fun onNewIntent(intent: Intent) {
    super.onNewIntent(intent)
    val deepLinkUri: Uri? = intent.data
    deepLinkUri?.let { uri ->
        val productId = uri.lastPathSegment
        navController.navigate("product_detail/$productId")
    }
}
05

Common Deep Linking Pitfalls, CDN Caching & Zero-Leak Security

Apple caches AASA files on its own Apple CDN servers (app-site-association.cdn-apple.com). During development, changes on your domain may take up to 24-48 hours to propagate unless you append ?mode=developer to your Xcode Associated Domains entitlement (e.g. applinks:example.com?mode=developer). On Android, failing to include Google Play App Signing SHA-256 certificate fingerprints will cause App Links to fail in production while working in debug builds. WebCraftKit validates all fingerprints and schemas entirely inside your browser with complete confidentiality.

Knowledge Base & Clarifications

Frequently Asked Questions: Deep Link Studio

Got questions about how Deep Link Studio operates, client-side cryptographic safety, or performance limits? Explore common answers below.

Complementary Utilities

Related Developer Tools

View all in Mobile & Apps →
Mobile & Apps Essential

Strings Converter

Bi-directional localization converter between Android strings.xml, iOS Localizable.strings, Flutter ARB, and JSON with format specifier validation.

Open Tool →
Mobile & Apps Essential

App Icon Generator

Generate complete Xcode AppIcon.appiconset with Contents.json and Android mipmap adaptive icon suites from a single 1024x1024 master image.

Open Tool →
Dev & Data Updated

URL Encoder

Encode and decode query strings and parse complex URLs into editable key-value tables.

Open Tool →
SEO & Webmaster Popular

Robots.txt Generator

Create optimized robots.txt files with directives for search engines and modern AI web crawlers.

Open Tool →