App Link: what it is, how it works and setup

What is App Link

App Link (Android App Link) is a standard HTTPS link that, when clicked on an Android device, automatically opens the installed app without showing the standard choice dialog between browser and app. Google introduced App Link in Android 6.0 (API 23) as a solution to the “chooser dialog” problem, which reduced deep link conversion due to the extra click and user confusion.

The key innovation: verification. Android verifies that the domain actually belongs to the app developer through the Digital Asset Links API. Google Play Store checks App Link upon publication and can reject an update if verification fails. This makes App Link more secure than Custom URL Scheme: no other app can intercept a link to your domain.

Digital Asset Links is an open protocol that Google uses not only for App Link but also for linking websites with apps in search results, Google Assistant, and Smart Lock for Passwords. The protocol is based on cryptographic verification: in assetlinks.json, the SHA256 fingerprint of the app's signing certificate is specified, which eliminates forgery.

How App Link Works

The App Link workflow consists of three stages: Digital Asset Links verification, processing through Intent Filter, and automatic redirect. Each stage is mandatory. If verification fails, Android shows a choice dialog — such a deep link works as usual but without the advantage of automatic transition.

Digital Asset Links (assetlinks.json)

Asset Links is a JSON file placed on the server at https://domain/.well-known/assetlinks.json. The file contains an array of objects with fields: relation (an array of strings describing the relationship type), target (an object with namespace and package_name of the app, as well as sha256_cert_fingerprints — an array of SHA256 fingerprints of the signing certificate).

// assetlinks.json — minimal App Link configuration
[{
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
        "namespace": "android_app",
        "package_name": "com.example.app",
        "sha256_cert_fingerprints": [
            "14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:AD:A4:C5:AD:6B:01:14:79:6B:CB:12:6B:21:39:6F:EA"
        ]
    }
}]

SHA256 fingerprint is obtained from the certificate used to sign the app. For debug builds, the standard Android debug certificate is used; for release builds, the certificate from Google Play Console or your own. Important: when changing the signing certificate (for example, when switching to App Signing by Google Play), you must update assetlinks.json on the server, otherwise App Link will stop working.

Intent Filter and Verification

Android verifies App Link on the first click on a link. The system downloads assetlinks.json from the server, checks the package_name and SHA256 fingerprint against the installed app's certificate. If the data matches, Android marks the Intent Filter as verified, and all subsequent links to this domain open automatically, without a dialog.

// AndroidManifest.xml — Intent Filter for App Link
<activity
    android:name=".ui.ProductActivity"
    android:exported="true">
    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data
            android:scheme="https"
            android:host="example.com"
            android:pathPrefix="/product" />
    </intent-filter>
</activity>

autoVerify="true" is a mandatory attribute that tells Android to verify assetlinks.json. Without this attribute, the Intent Filter will not be verified and App Link will not be activated. Android supports multiple Intent Filters in one Activity — for different hosts. The system checks each host separately. Verification is performed asynchronously and can take up to 20 seconds on the first click.

Automatic Redirect

After successful verification, Android automatically opens the app when clicking any link that matches the verified Intent Filter. The user does not see a choice dialog — the app opens instantly. If the app is not installed, the link opens in the browser (as a regular web page). This is the ideal user experience: seamless transition without unnecessary actions.

Important: automatic redirect only works for the https scheme. App Link does not support http (unsecured protocol). If a user manually opens an http link (for example, from SMS), Android does not perform verification and shows a choice dialog. It is recommended to use https for all links leading to the app and configure HTTP to HTTPS redirect on the server.

App Link vs Deep Link

App Link is the evolution of Deep Link on Android, not a replacement. The difference between them is fundamental. Regular Deep Link (Custom URL Scheme) works through an Intent Filter with a custom scheme (myapp://) and without autoVerify. Android does not check whether the app is actually associated with this scheme — any app can register myapp:// and intercept links.

App Link solves three problems of Deep Link. First: security — verification through Digital Asset Links prevents link interception. Second: user experience — the absence of a choice dialog increases conversion to the target action by 20–40%. Third: indexing — Google indexes https App Link URLs and can show them in search results as links to content inside the app.

Compatibility: App Link works on Android 6.0+ (99% of devices). For Android 5.x (Lollipop), regular Deep Link with a choice dialog is used. Therefore, it is recommended to support both mechanisms: App Link for modern devices and Custom URL Scheme as a fallback for older versions. An Intent Filter with autoVerify="true" does not break backward compatibility — on Android < 6, the attribute is ignored.

App Link Setup

Setting up App Link requires three steps: configuring the Intent Filter in the manifest, placing assetlinks.json on the server, and verifying the verification. The first step is to add an Intent Filter with android:autoVerify="true" in AndroidManifest.xml. It is important to specify the https scheme, host, and paths that the app should handle. Paths can contain wildcards (*) for subfolders.

The second step is creating assetlinks.json. The file can be generated through Android Studio (Tools → App Links Assistant). The assistant also helps with debugging and testing. The file is placed on the server at /.well-known/assetlinks.json. The server must return Content-Type: application/json and be accessible via HTTPS without redirects. Google Play Console also shows the App Link verification status in the Publishing section.

1. Add an Intent Filter with android:autoVerify="true" in AndroidManifest.xml
2. Obtain the SHA256 fingerprint of the certificate (keytool or App Links Assistant)
3. Create assetlinks.json with package_name and sha256_cert_fingerprints
4. Place the file at /.well-known/assetlinks.json on an HTTPS server
5. Verify verification via adb: adb shell dumpsync domain_verification

Testing is the third step. Use adb to check: the command adb shell am start -W -a android.intent.action.VIEW -d “https://example.com/product/42” opens the app. If the browser opens instead of the app, check assetlinks.json and autoVerify. Android Studio App Links Assistant contains a built-in tester: it shows the verification status for each domain and path. For automated testing, use Android Testing Library with Intent Matcher.

Implementation Notes

Android 12 (API 31) introduced changes to App Link handling. A new domain-specific verification was added: the system checks each link individually, not the entire Intent Filter. This improves security but requires updating the assetlinks.json file when adding new paths. Android 12 also introduced Android App Links Assistant bundled with ADB — commands for managing verification via shell.

Multiple domains is a typical scenario for production. An app can handle links from example.com, m.example.com, and example.org. Each domain requires a separate assetlinks.json on the corresponding server. In the manifest, multiple Intent Filters are added — one per domain. All domains must be accessible via HTTPS and pass verification independently.

App Link and Jetpack Navigation is the recommended way to handle App Link in modern Android apps. Jetpack Navigation supports declarative deep links in nav_graph.xml or via NavDeepLinkRequest. This simplifies navigation: the developer describes which screen opens for a given URL, and the Navigation component handles the Intent and restores the navigation stack itself. Google recommends using Jetpack Navigation for App Link.

// Processing App Link via Jetpack Navigation
class MainActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)
        handleDeepLink(intent)
    }

    override fun onNewIntent(intent: Intent) {
        super.onNewIntent(intent)
        handleDeepLink(intent)
    }

    private fun handleDeepLink(intent: Intent) {
        intent.data?.let { uri ->
            navController.handleDeepLink(NavDeepLinkRequest
                .Builder
                .fromUri(uri)
                .build()
            )
        }
    }
}

Google Play Store checks App Link upon publication. If the manifest contains an Intent Filter with autoVerify but assetlinks.json is unavailable or incorrect, Google Play may reject the update with a warning. In the developer console (Policy and Programs → App Links), the verification status of each domain is displayed. Before publishing, always check the status — fixing it after an update rejection delays the release.