How to Validate iOS Universal Links & Android App Links
Learn how to audit Apple App Site Association (AASA) and Android Digital Asset Links (assetlinks.json) manifests with syntax linting and physical QR testing.
In-Browser Manifest Linter & QR Verification Model
Files remain in local browser memory. Processing runs client-side.
1. Local Ingest
Your browser queries local file headers or byte structures directly using standard HTML5 File APIs.
2. Browser Processing
The data is loaded exclusively into your browser's isolated session memory (RAM).
3. Generated Output
Outputs (like compiled results or CSV logs) are written directly to your system download folder.
1. Understanding Two-Way Domain Association
Legacy custom schemes (such as twitter:// or spotify://) allowed any malicious application to claim ownership of another company's protocol. To prevent scheme hijacking and phishing, modern mobile platforms (iOS and Android) enforce cryptographically secure two-way domain association:
Two-Way Cryptographic Domain Association Architecture
For a deep link to open natively, both sides must declare the relationship: the mobile application binary declares which domains it handles in its internal entitlements/manifest, and the website's web server hosts a signed, publicly accessible JSON manifest in its /.well-known/ directory declaring which specific mobile apps are authorized.
2. Interactive Workspace Anatomy & Control Breakdown
Master every control, parameter slider, and export action in the interactive workspace:
Workspace Controls & Parameter Specification
Enter root domain or staging subdomain to test live Apple and Android association endpoints.
Inspects /.well-known/apple-app-site-association for valid JSON, content-type headers, and appID structures.
Validates /.well-known/assetlinks.json syntax, package names, and SHA-256 cert fingerprints.
Checks format of App IDs (TEAMID.com.example.app) against Apple Developer Portal requirements.
Test URL paths against path match and exclude arrays (e.g. /items/*, NOT /checkout/*) to predict routing.
Download full diagnostic log detailing HTTPS certificate validity, redirect status, and syntax errors.
3. Apple AASA vs Android assetlinks.json Standards
Apple and Google enforce distinct file formats and validation behaviors:
The No-Extension Filename Rule for iOS
4. Step-by-Step Deep Link & Manifest Audit
Audit link syntax and generate server manifest templates locally:
Paste Target Deep Link or URL
Enter your HTTPS deep link URL or select a built-in e-commerce or streaming preset.
Inspect Route Classification
Review extracted URI components: scheme, domain, path hierarchy, and query parameter keys.
Audit Server Manifest Configuration
Lint and validate the generated apple-app-site-association and assetlinks.json manifests.
Scan Device QR Code for Live Verification
Scan the on-screen QR code with your iPhone or Android device camera to verify native handoff.
Which mobile platform manifest are you configuring?
Select an option below to reveal our recommended pathway.
5. SHA-256 Fingerprints & Apple Team ID Binding
Each platform binds domain ownership using platform credentials:
iOS: Team ID + Bundle Identifier
Concatenate your 10-character Apple Developer Team ID with your app bundle ID, separated by a period (e.g. 9JA89QGQL6.com.example.store). This unique string binds the web domain to your authorized App Store development team.
Android: SHA-256 Keystore Fingerprint
A 32-byte colon-separated hexadecimal string extracted from your release keystore certificate (e.g. 14:6D:E9:...). If using Google Play App Signing, extract this from the Play Console rather than your local upload key.
6. Practical Workflows: E-Commerce, Streaming & QA
Configure association manifests to route specific URLs to app screens while keeping corporate pages in web browsers:
1. E-Commerce Product Routing with Web Exclusions
Route product pages (/products/*) and categories (/category/*) into your native app, while explicitly excluding administrative login panels (/admin/*), terms of service (/terms), and help documentation to keep them rendering inside mobile web browsers.
2. On-Device Camera QR Quality Assurance
Generate your universal link string and display the test QR code on your workstation monitor. Scan the code using your physical iPhone and Android test devices to verify that the camera app immediately displays the yellow "Open in [App]" badge.
7. Common Deployment Mistakes to Avoid
8. Troubleshooting Apple CDN Caching & Android Checks
If universal links fail to open despite passing JSON linting tests:
Troubleshooting Guidelines
- • Apple Universal Link Caching Delay: Since iOS 14, Apple scrapes association files through an intermediate Apple CDN rather than directly from your server. Updates to your AASA file can take 24 to 48 hours to propagate across Apple CDN caches.
- • Android Verification Failure in Logcat: Run adb shell pm get-app-links com.example.app on your connected test device. If status shows "1024" or "failed", your server is blocking Google's verification bot or returning an invalid SSL certificate.
- • Missing Subdomain Manifests: If your deep links use links.example.com or app.example.com, you must host the association files on those exact subdomains, not merely on the apex root domain example.com.
9. Client-Side App Routing Verification Privacy
Auditing mobile application manifests involves handling confidential production keystore fingerprints, unreleased application bundle IDs, and staging domain hierarchies.
The SHRTX Universal Link and App Routing Tester performs all JSON schema validation, regex routing checks, and QR code rendering entirely inside your client browser thread. Zero manifest strings, package IDs, or certificate fingerprints are uploaded to any external server or saved in persistent cloud stores.
10. Pre-Flight Mobile Manifest Deployment Checklist
Verify these points before deploying your association manifests to production web servers:
Association Manifest Deployment Checklist
Complete these checks before sharing or uploading your files.