Universal Links / Android App Links
A normal https link that opens your app if it is installed and your website if it is not, proved by a verification file on your domain.
See it
What it is
One ordinary https URL that the OS routes to your app when it is installed and to your website when it is not. No interstitial, no myapp:// weirdness, no broken tap. The trick is domain verification: iOS fetches an apple-app-site-association file from the /.well-known/ folder on your https domain, Android fetches assetlinks.json from the same folder, and each file names the app IDs plus (on Android) the SHA-256 fingerprints of your signing certs. Only an app you can prove you own gets to claim your URLs.
Use them for anything a human might paste, forward, or scan: share links, email CTAs, ad landing pages, invite links. Because the same URL works in both worlds, marketing gets to stop maintaining two link sets, and desktop recipients get a real page instead of an error.
Gotchas that eat days: the association file must be served over https with no redirects, as application/json, and iOS caches it aggressively (via Apple's CDN) so edits are not instant. Several of the confusing 'it doesn't work' reports are iOS Universal Link behavior specifically: typing the URL into Safari's address bar deliberately does not open the app, and neither do most same-domain in-page links. Android App Links dispatch by their own rules, so do not assume a test result from one platform describes the other. On iOS a user who once long-pressed and chose 'Open in Safari' stays opted out until they choose 'Open in app' from the banner. And the whole thing is silent: if verification fails, links just quietly open the web page.
Ask AI for it
Set up Universal Links and Android App Links for my production domain [DOMAIN]. Generate the apple-app-site-association JSON (applinks details with appID [TEAM_ID].[BUNDLE_ID] and path patterns [INCLUDE PATHS], excluding [EXCLUDE PATHS]) and the assetlinks.json (delegate_permission/common.handle_all_urls, package name [ANDROID_PACKAGE_NAME], and only the release signing SHA-256 fingerprint [RELEASE_SHA256]). Keep the debug fingerprint out of the production file entirely: put it in a separate assetlinks.json on my development domain [DEV_DOMAIN] instead, so a debug key can never claim production URLs. Serve both files from /.well-known/ over https with no redirects and Content-Type application/json. Then add the iOS Associated Domains entitlement for the matching domain per build configuration and the Android intent-filter with android:autoVerify="true", and wire the incoming URL to the existing deep link router. Include the exact commands to verify association on a real device for each platform.