Universal Links & App Links: A Technical Guide

The Modern Standard for Secure, Reliable Deep Links

In the early days of mobile, deep linking relied on custom URI schemes (e.g., `yourapp://path`). This method was flawed: it provided no easy way to fall back to a website if the app wasn't installed, and it was insecure, allowing any app to claim any URI scheme.

To solve this, Apple and Google introduced secure, web-based deep linking standards: Universal Links for iOS and App Links for Android. Both technologies use standard `https` URLs and a cryptographic verification process to create a secure association between a website domain and a mobile app. This ensures that only the legitimate owner of a domain can direct links from that domain into their app.

This guide will walk you through the technical implementation of both systems, highlighting the precise steps and common errors that teams encounter.

How Universal Links Work (iOS)

Universal Links create a secure bridge between your domain and your iOS app. The entire system is built on a foundation of trust, verified by a special file you host on your web server.

Here's the flow:

1. Your app declares in its project settings which domains it is associated with (e.g., `applinks:www.example.com`).
2. When a user installs or updates your app, iOS automatically attempts to fetch a file from a well-known location on that domain: `https://www.example.com/.well-known/apple-app-site-association`.
3. This file, commonly called the AASA file, is a JSON that contains a list of app identifiers and the URL paths they are allowed to handle.
4. If iOS successfully fetches a valid AASA file that includes your app's identifier, it creates the association.
5. From then on, when a user taps a link to an approved path on `www.example.com` (e.g., in an email or text message), iOS opens your app directly instead of Safari.

Step-by-Step: Configuring the AASA File

Correctly creating and hosting the AASA file is the most critical and error-prone part of implementing Universal Links.

{
  "applinks": {
    "apps": [],
    "details": [
      {
        "appID": "YOUR_TEAM_ID.com.yourcompany.yourapp",
        "paths": [ "/products/*", "/articles/2025/*" ]
      }
    ]
  }
}

How App Links Work (Android)

Android App Links function very similarly to Universal Links. They use standard `https` URLs and a verification process to ensure the app is the legitimate owner of the domain.

1. You add `intent-filter` tags to your app's `AndroidManifest.xml` that declare which `https` URLs your app can handle. You must include `android:autoVerify="true"`.
2. You host a special JSON file called `assetlinks.json` at a well-known location on your domain.
3. When a user installs your app, the Android OS checks for this file. It verifies that the file is valid and contains your app's package name and certificate fingerprint.
4. If verification succeeds, the OS designates your app as the default handler for those URLs. Tapping a matching link will then open your app directly.

Step-by-Step: Configuring the `assetlinks.json` File

[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.yourcompany.yourapp",
    "sha256_cert_fingerprints":
    ["YOUR:SHA256:FINGERPRINT:HERE"]
  }
}]

Common Pitfalls & Troubleshooting

This is where teams waste the most time. A single misconfiguration can cause the entire system to fail silently. Here are the most common issues:

The Infrastructure Solution: This Shouldn't Be Your Problem

As you can see, the process is brittle and requires careful coordination between mobile developers, web developers, and DevOps. A single change to your server configuration by the web team can silently break your entire mobile deep linking strategy.

This is a problem best solved at the infrastructure level. A lightweight, API-first service like SDDL abstracts away all of this complexity. Instead of managing these files yourself, you provide your app's details to us, and we handle the rest:

• Automated File Generation: We create perfectly formatted AASA and `assetlinks.json` files for you.
• Bulletproof Hosting: We serve these files from a globally distributed, high-availability infrastructure, guaranteeing they are always available with the correct headers and without redirects.
• Simplified Management: Need to add a new path or domain? Update it via a simple API call. No need to file a ticket with your web team and wait two weeks.

This lets your team focus on building great app features, not debugging server configurations.

FAQ