Deep Links, Universal Links and App Links for Converted Apps

Converted apps live next to a website, and users constantly share URLs: product pages, invitations, password reset emails, campaign links. If tapping such a link opens a browser instead of your app, you lose the best moments for engagement. Deep linking fixes that, but the setup has several moving parts that must agree with each other.

The vocabulary, simply

• Deep link: any link that opens a specific place inside an app.
• Custom URL scheme: a link like myapp://item/42. Easy to set up, but not verified, so any app can claim it, and it does nothing when the app is missing.
• Universal Links (iOS): normal https links that open your app when installed, verified through a file on your domain.
• App Links (Android): the Android equivalent, also verified through a file on your domain.
• Deferred deep link: a link that survives the install, so a new user lands on the intended content after first launch. This usually needs a link-routing service or custom logic.

For websites turned into apps, prefer verified https links. They work for existing URLs, and they degrade gracefully into normal web pages.

What you need to configure

1. Decide the URL patterns: which paths open the app and which stay in the browser, for example product and invite pages yes, marketing pages no.
2. Host the association files: iOS uses an association file served from a well-known path on your domain, Android uses a digital asset links file there. Both must be served over HTTPS without redirects, with correct content types.
3. Declare the domains in the apps: iOS via associated domains in the app's capabilities, Android via intent filters with automatic verification.
4. Implement routing: when the app receives a link, parse it and navigate to the right screen, including when the app is cold-started by the link.
5. Handle authentication: if the destination needs login, send users through sign-in and then continue to the original destination.
6. Test on real devices with fresh installs.

The exact file formats, fields and paths change over time, so follow the current Apple and Google developer documentation rather than copying old snippets from forums.

Routing inside a web view app

If your app mostly shows your website in a web view, the simplest pattern is to receive the incoming URL in the native layer, verify it belongs to your domain and load it in the web view. For hybrid apps with native screens, map URL patterns to screens in one central router so web and app stay consistent. Keep this mapping in one place; scattered link handling is the main source of bugs.

Common failure causes

• The association file is behind a redirect, has the wrong content type or is blocked by a firewall or login.
• The domain in the app does not exactly match the domain in links, for example a missing subdomain.
• Links pasted into some in-app browsers, messengers or notes apps open the browser instead of the app. This is platform behavior, not always a bug.
• The signing certificate fingerprint on Android does not match the one in the asset links file, which often happens when store signing changes it.
• Cached verification results after changes. Reinstall and test again.

Security and privacy

Treat every incoming link as untrusted input. Validate paths and parameters, never execute actions such as deleting data or confirming payments from a link alone, and avoid placing secrets or personal data in URLs. Password reset and invite links should use short-lived, single-use tokens.

Use deep links to grow

Good use cases are order tracking from email, invitations, referral links and push notifications that open the relevant screen. Combine them with analytics, as covered in Analytics for Converted Apps, to see which links bring people back. Push notifications themselves are explained in Adding Push Notifications to AI-Built Apps.

How apprat.io handles linking

This is a classic area where coding agents help with the repetitive routing code while the details of certificates, domains and platform behavior need an experienced person. Our AI Code Engineers configure the domain files, review every change the agents make, test links on real iOS and Android devices and verify the setup again after store signing. Questions about your own domain setup? Book a call for free.