Deep links and App Links

Modern Android Mid-level Kotlin 2.0+ API 24+ Reviewed By Best Latest Apps

Pick the fix

App Links work in debug builds but open the browser for Play users. Likely cause?

Options
Hint 1 of 1

Who signs the app users install from Play?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A assetlinks.json lacks the Play App Signing certificate fingerprint

Correct. Play re-signs the app with a different key.

Why not the others?
  • B Missing INTERNET permission. Not related to link verification.
  • C The intent filter needs a custom scheme. That would make it a plain deep link.
  • D Users must enable developer options. Not required.

30-second answer

A deep link is any URI that opens a screen in your app via an intent filter with VIEW, DEFAULT and BROWSABLE. An App Link is an https link verified with autoVerify and a /.well-known/assetlinks.json file on your domain, so it opens your app directly without a chooser. Since Android 12, unverified web links open in the browser. Route the URI to a screen, such as with navDeepLink, and validate its input.

Practise saying it · 30 s. No recording, just a timer

Explain deep links vs App Links.

Say your answer out loud, then check which of these points you covered:

  • Intent filter with VIEW/BROWSABLE
  • App Links: https + autoVerify + assetlinks.json
  • Unverified opens browser since 12
  • Route and validate
  • Sensible back stack

Deep dive

Test verification with adb shell pm get-app-links <package>.

assetlinks.json lists your package and signing certificate fingerprints, including Play App Signing's.

Build a sensible back stack so Back after a deep link doesn't exit unexpectedly.

Treat parameters as untrusted, like any external input.

A verified App Link filter
<activity android:name=".MainActivity" android:exported="true">
    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:scheme="https" android:host="example.com" android:pathPrefix="/articles" />
    </intent-filter>
</activity>

Common mistakes

  • Forgetting Play App Signing's certificate in assetlinks.json.
  • Trusting IDs from the link without checks.
  • Custom schemes for links that should be https App Links.

Senior take & follow-ups

Define both, then verification and routing; mention Android 12 behaviour.

Follow-up questions

Think of your answer first, then open the hint.

  1. Why do App Links fail after Play App Signing?

    Show hint

    The app is signed with Google's key; its fingerprint must be in assetlinks.json.

  2. What should Back do after a deep link?

    Show hint

    Go to a sensible parent screen, not straight out of the app.

Compare on iOS: Reliable universal links Universal Links use an apple-app-site-association file; App Links use assetlinks.json.

Related questions

Free tool

assetlinks.json validator

Free tool: generate and check your Digital Asset Links file, including the Play App Signing fingerprint that App Links and passkeys need.

Open the tool

Suggest a fix if something here is wrong or out of date.