# Deep links: open your app from a link

Source: https://saastostore.com/docs/deep-links

A deep link opens your app on the right page, not the browser. Someone taps a link to `https://example.com/orders/42` in an email and lands on that order in the app. Phones only allow this if your domain confirms that the app belongs to you, through one small file on your site.

## What you need

- The [Deep links plugin](https://saastostore.com/plugins/deep-links) turned on in your project
- A native build: Android Build (Native), or iOS with native navigation
- One file on your site for Android, and one for iOS

## Android: assetlinks.json

Host this file at exactly `https://your-domain/.well-known/assetlinks.json`. Once you have a build, your project page shows the file filled in with your package name and SHA-256 fingerprint, ready to download.

```json
[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.app",
      "sha256_cert_fingerprints": ["AB:CD:…:EF"]
    }
  }
]
```

> The Android Build (Web) needs this same file for another reason: without it, the app shows an address bar.

## iOS: apple-app-site-association

Host this file at `https://your-domain/.well-known/apple-app-site-association`. It has no extension, and your server must send it as `application/json`, with no redirect. Your project page gives you the exact file.

```json
{
  "applinks": {
    "apps": [],
    "details": [
      { "appID": "TEAMID.com.example.app", "paths": ["*"] }
    ]
  }
}
```

> **Warning:** A wrong `appID` is the most common trap. The file still looks valid, but links silently open Safari. Use the file from your project page, not a hand-written one.

## Check your files

Enter your domain in the [deep link validator](https://saastostore.com/tools/deep-link-validator). It fetches both files as a phone would and tells you what's wrong: wrong address, wrong format, missing fingerprint or a redirect.

## How to host the files

| Platform | How |
| --- | --- |
| Lovable, Bolt, Vite | Put them in `public/.well-known/` |
| Next.js | Put them in `public/.well-known/`, or serve them from a route |
| Webflow, Bubble, Framer | These don't always allow files at that path. Use a proxy or a worker in front of your domain, or a route on a subdomain |
| Your own server | Serve the files as static, with `application/json` |

## Test on a real phone

1. **Install the app** Android checks your file when the app is installed. iOS gets it through Apple's servers, which can take a while after a change.
2. **Tap a link from another app** Use a notes app or a message. Typing the address in the browser's address bar doesn't count: it stays in the browser.
3. **Check the page** The app should open on that exact page. If your site has a sign-in, test it when signed out too.

## Frequently asked questions

### Links stopped opening the app after publishing on Google Play. Why?

Google Play re-signs your app with its own key, so the fingerprint changes. Add the SHA-256 of the app signing key, shown in the Play Console under App signing, to assetlinks.json next to the existing one.

### Do I need deep links for Google sign-in?

No. Google sign-in returns through your app's own address, as explained on the sign-in page. Deep links are for https links to your site.

### Does a deep link work if the app isn't installed?

The link opens your website in the browser, as usual. That's why the same address works for everyone.

### Why does my iOS deep link still open Safari?

Check the file with the validator first. Then check the appID, which must use the Apple team that signed the app. Also check that your iOS build uses native navigation, as deep links need it on iOS.