URI Scheme: What It Is and How Custom URL Schemes Work

A URI scheme is the first component of a URI, the part before the colon, that tells software which protocol or application should handle the rest of the address. In https://linkutm.com, the scheme is https. In myapp://product/12345, the scheme is myapp, and it routes the request to an installed app instead of a web server.

https://linkutm.com/glossary?ref=email
^^^^^
scheme

“URI scheme” and “URL scheme” mean the same thing. URI is the term used in the specifications, URL is what most developers say.

How a URI Scheme Works

The scheme is a routing instruction, not part of the destination. When a device sees a link, it reads everything up to the first colon, looks that name up in its handler registry, and passes the remainder of the string to whichever program claims it.

RFC 3986 Section 3.1 sets the syntax rules:

A scheme name starts with an ASCII letter, followed by any mix of letters, digits, +, -, and .
Scheme names are case insensitive. HTTPS:// and https:// resolve identically, and the specification says to normalize to lowercase.
The colon is a delimiter and is not part of the scheme name itself.
The double slash that follows is optional. It signals that an authority component (a host, and sometimes a port and credentials) comes next. Schemes with no host skip it, which is why mailto:[email protected] and tel:+14155550123 have no slashes.

The last point is the one most people get wrong. https:// is not the scheme. https is the scheme, and :// is punctuation.

Registered and Private URI Schemes

Schemes fall into two groups: names registered with IANA, and private-use names an app invents.

IANA maintains the official Uniform Resource Identifier (URI) Schemes registry under RFC 7595 (BCP 35). As of 24 August 2026 it holds 431 entries: 99 Permanent, 314 Provisional, and 18 Historical. Permanent status requires a published specification and expert review. Provisional covers everything else, from bitcoin to zoomus.

Scheme	Handled by	Example
`https`	Browser, over TLS	`https://linkutm.com/pricing`
`mailto`	Default email client	`mailto:[email protected]?subject=Demo`
`tel`	Phone dialer	`tel:+14155550123`
`data`	Inline content, no fetch	`data:text/plain;base64,SGk=`
`whatsapp`	WhatsApp app	`whatsapp://send?text=Hello`

Private-use schemes are never registered. Any app can declare one. RFC 7595 Section 3.8 recommends basing them on a domain the developer controls, written in reverse: com.example.myapp: rather than myapp:. RFC 8252 makes that mandatory for OAuth redirects in native apps, and tells authorization servers to reject any private-use scheme with no period in it.

Custom URL Scheme Example

A custom URL scheme, also called an app URL scheme, is a private-use scheme registered by a mobile app so links can open it directly. Registration happens in the app manifest, read by the OS at install time.

On iOS, declare the scheme in Info.plist:

<key>CFBundleURLTypes</key>
<array>
  <dict>
    <key>CFBundleURLName</key>
    <string>com.example.myapp</string>
    <key>CFBundleURLSchemes</key>
    <array>
      <string>myapp</string>
    </array>
  </dict>
</array>

On Android, declare it as an intent filter in AndroidManifest.xml:

<activity android:name=".DeepLinkActivity" android:exported="true">
  <intent-filter>
    <action android:name="android.intent.action.VIEW" />
    <category android:name="android.intent.category.DEFAULT" />
    <category android:name="android.intent.category.BROWSABLE" />
    <data android:scheme="myapp" android:host="product" />
  </intent-filter>
</activity>

Both make this link open the product screen for item 12345:

myapp://product/12345?utm_source=newsletter&utm_medium=email

A link built this way is a scheme-based deep link. The query string survives the handoff, so the app can read tracking parameters on launch and forward them to analytics.

URL Scheme vs Universal Link

Custom schemes are legacy. Apple and Google recommend verified HTTPS links for new apps, because a custom scheme proves no ownership.

Aspect	Custom URI scheme	Universal Link (iOS) / App Link (Android)
Format	`myapp://product/12345`	`https://example.com/product/12345`
Ownership verified	No. Any app can claim the name.	Yes, through a file hosted on the domain
App not installed	Fails to a blank page or error	Falls back to the web page
Setup	Manifest entry only	`apple-app-site-association` or `assetlinks.json`
Works in email and in-app browsers	Often blocked or stripped	Yes, it is an ordinary HTTPS link
Recommended for new apps	No	Yes

The verification gap is the real problem. Two apps can register myapp, and iOS gives no guarantee about which one wins. That is scheme hijacking. OWASP’s Mobile Application Security guidance treats data passed over a custom scheme as data handed to an untrusted receiver.

Common Problems With Custom Schemes

Silent failure. Tapping myapp:// with the app missing produces an error page, not a store redirect. Deferred deep linking exists to solve exactly this.

Stripped in third-party surfaces. Email clients, Slack, and in-app browsers inside Instagram and Facebook often refuse to render a non-HTTPS scheme as a clickable link.

No referrer, no automatic tracking. A custom scheme link never makes an HTTP request, so there is no referrer header and no page view. Attribution depends entirely on the app parsing the query string itself. Tag those links with the same naming conventions used everywhere else so app opens reconcile against web campaign data.

The iOS 50-scheme cap. Since iOS 9, canOpenURL: returns false for any scheme not listed under LSApplicationQueriesSchemes, and apps built against iOS 15 or later are capped at 50 entries. Apps cannot enumerate what else is installed.

Frequently Asked Questions

What is a URI scheme?

A URI scheme is the label at the start of a URI, before the colon, that identifies which protocol or application handles the address. Examples include https, mailto, tel, and ftp. The device matches it against its registry of handlers and passes the rest of the string to whatever claims it. RFC 3986 defines the syntax.

What is the difference between a URI scheme and a URL scheme?

There is no practical difference. Every URL is a URI, so a URL’s scheme is a URI scheme. The specifications use “URI scheme” and IANA names its registry that way, while Apple’s and Google’s developer documentation says “URL scheme”. Treat them as the same thing.

What is a custom URI scheme example?

myapp://product/12345 is the standard shape: a private scheme name, a host that names the screen, and a path that identifies the record. Real ones include whatsapp://send, spotify:track: and fb://profile. Following RFC 8252, the safer form uses a reverse domain name, such as com.example.myapp://product/12345.

Is a URL scheme or a Universal Link better for deep linking?

Universal Links, in almost every case. They verify app ownership through a file hosted on the domain, they fall back to the website when the app is not installed, and they work as normal links inside email and in-app browsers. Custom schemes stay useful for app-to-app calls and OAuth redirects.

Are URI schemes case sensitive?

No. RFC 3986 defines scheme names as case insensitive, so HTTPS, Https, and https are equivalent. Lowercase is the canonical form and the one to use. Paths and query values after the scheme are usually case sensitive.

To keep app-scheme links reconciling against web campaigns in the same reports, build them with the free UTM builder at linkutm.