Android App Links: How They Work and How to Set Them Up

Android App Links are standard HTTPS URLs that open a specific screen in an Android app without asking the user which app to use. Android verifies that the app and the website belong to the same owner through a Digital Asset Links file, assetlinks.json, hosted on the site. If the app is not installed, the same URL opens the web page.

Why Android App Links Matter

Android App Links are the only reliable way to send a web URL straight into an Android app on Android 12 and later. Since Android 12 (API level 31), Google’s documentation states that a web link resolves to an app only if that app is verified for the domain. Unverified links open in the default browser.

That makes App Links the Android standard for any link that should land inside the app: email campaigns, paid social ads, QR codes, and SMS.

Verification also adds security. Another app cannot claim your verified domain and intercept your links. App Links are the Android equivalent of iOS universal links.

Android App Links vs Deep Links vs Web Links

Google’s Android documentation describes three types of deep link. Android App Links are the verified version of the second type.

Type	Example	Verified	Behavior on Android 12+
Custom scheme deep link	`example://products/123`	No	Opens the app if installed, can show a chooser if another app claims the scheme
Web link	`https://example.com/products/123`	No	Opens in the browser by default
Android App Link	`https://example.com/products/123`	Yes	Opens the app directly, falls back to the website

Android App Links have been available since Android 6.0 (API level 23). They require a device with Google services installed.

How Android App Links Work

Verification happens at install, not at click time:

The app’s manifest declares an intent filter for the domain with android:autoVerify="true.
When the app is installed, Android fetches https://example.com/.well-known/assetlinks.json.
Android checks that the file lists the app’s package name and a SHA-256 fingerprint matching its signing certificate.
When a user taps a matching link, Android opens the app directly, with no disambiguation dialog.

The app receives the full URL, query string included.

How to Set Up Android App Links

Setup needs one change in the app and one file on the server. First, add an intent filter to AndroidManifest.xml:

<intent-filter android:autoVerify="true">
  <action android:name="android.intent.action.VIEW" />
  <category android:name="android.intent.category.DEFAULT" />
  <category android:name="android.intent.category.BROWSABLE" />
  <data android:scheme="http" />
  <data android:scheme="https" />
  <data android:host="www.example.com" />
</intent-filter>

Then publish assetlinks.json on each domain:

[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.example.app",
    "sha256_cert_fingerprints": ["14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5"]
  }
}]

Google’s hosting rules for the file:

Location: https://yourdomain/.well-known/assetlinks.json, on every host in the intent filter.
Content type: served as application/json.
HTTPS only: even if the intent filter also lists http.
No redirects: a 301 or 302 on the file fails verification.

Dynamic App Links (Android 15)

Android 15 (API level 35) added Dynamic App Links, which move path rules from the app into assetlinks.json. A dynamic_app_link_components block can match paths, fragments, and query parameters, and can exclude URLs from opening the app.

Devices with Google services re-fetch the file periodically, so a new rule such as /promo/summer-sale goes live without an app update. Google lists seasonal campaigns, partner vanity URLs, and A/B testing as intended uses.

Server rules can only narrow what the manifest allows, never expand it. Google recommends declaring only the scheme and domain in the manifest and handling path routing on the server. Devices on Android 14 and lower ignore the dynamic rules and use the manifest.

How to Test Android App Links

Install the app, wait at least 20 seconds for verification to finish, then check the status with adb:

adb shell pm get-app-links com.example.app

Each domain should show verified. Any other state, such as none or legacy_failure, means verification did not succeed. To force a fresh check after fixing the file, run adb shell pm verify-app-links --re-verify com.example.app.

Google’s Digital Asset Links API checks the server side without a device. Request https://digitalassetlinks.googleapis.com/v1/statements:list with your site and the delegate_permission/common.handle_all_urls relation. The Play Console Deep Links page and the Android Studio App Links Assistant also validate the setup.

Common Android App Links Issues

Wrong fingerprint with Play App Signing: a locally generated fingerprint usually does not match the key Google Play signs with. Copy the snippet from Play Console under Release > Setup > App signing.
Lowercase signature: Google’s troubleshooting guide says the fingerprint should be uppercase.
Domain redirects: redirecting http to https, or example.com to www.example.com, can block verification for that host.
One failing host on Android 11 and lower: if any declared host fails, none of the app’s links are verified. Android 12+ verifies each host separately.
Links on a different domain: Android checks the domain the user taps. A branded short domain or click-tracking domain needs its own assetlinks.json listing the app.

Frequently Asked Questions

What is Android deep linking?

Android deep linking is any link that opens a specific screen inside an Android app instead of its home screen. It covers custom scheme links like example://product/123, plain web links, and verified Android App Links. Android App Links are the type Google recommends for HTTPS URLs, because unverified web links open in the browser on Android 12 and later.

Are Android App Links the same as universal links?

No, but they solve the same problem. Universal links are Apple’s iOS version and use an apple-app-site-association file. Android App Links use assetlinks.json and a signing certificate fingerprint. Most apps set up both so one HTTPS URL opens the app on either platform.

Do Android App Links work if the app is not installed?

Yes. Android App Links are normal HTTPS URLs, so without the app they open the web page at the same address. They do not send the user to Google Play or carry the destination through an install. Routing a new user to the right screen after install requires a deferred deep link.

Why does my Android App Link open in the browser?

The domain is almost always unverified. Check that assetlinks.json is valid, served over HTTPS without redirects, and lists the right uppercase fingerprint. Then run adb shell pm get-app-links to confirm the domain shows verified.

Do Android App Links keep UTM parameters?

Yes, the app receives the full URL, including the query string. The UTM values are only recorded if the app reads them from the incoming intent and logs them to its analytics. Test this before launch, because many apps route on the path and ignore the query string.

To tag app-bound links with the same campaign parameters as your web links, build them with the free UTM builder at linkutm.