Custom URL scheme
A link like myapp:// that launches an installed app and routes inside it, without using an HTTP website address.
See it
What it is
A custom URL scheme is an address such as myapp://orders/42, where the word before the colon belongs to an installed app instead of to HTTP. The operating system launches an app registered for that scheme, then hands it the rest of the URL for routing.
Use one for controlled app-to-app handoffs, development tools, and OAuth callbacks when the identity provider requires a private-use scheme. It is quick to register in CFBundleURLTypes on iOS and an intent filter on Android, and it works without owning a web domain.
Gotcha: a scheme is not verified ownership. Another installed app can claim the same name, and when your app is absent there is no reliable website fallback. Treat every incoming URL as untrusted input, use a reverse-domain scheme for collision resistance as RFC 8252 recommends for native OAuth clients, and prefer Universal Links or Android App Links for links sent through email, ads, QR codes, or the open web.
Ask AI for it
Add the private-use scheme com.example.myapp to this app. Register it under CFBundleURLTypes in Info.plist and in an Android intent-filter with the BROWSABLE and DEFAULT categories. Route com.example.myapp://orders/:id and /oauth/callback through the existing deep-link parser on both cold and warm starts. Allowlist hosts and paths, reject unknown routes, validate and decode every parameter once, and never execute a command taken directly from the URL. For OAuth, require PKCE with a fresh code_verifier and verify the state parameter before exchanging the code. Add tests for malformed encoding, a missing ID, a repeated callback, and an unrecognized host.