ValidateURL.com

    Universal Links & App Links Validator

    Test iOS apple-app-site-association (AASA) and Android assetlinks.json configuration files. Verify Team IDs, Bundle IDs, and SHA-256 certificate fingerprints.

    Try Sample:

    1-Click Starter Configuration Snippets

    Need to set up or fix your files? Copy these validated starter templates and host them on your web server at /.well-known/.

    apple-app-site-association
    {
  "applinks": {
    "apps": [],
    "details": [
      {
        "appID": "TEAMID1234.com.example.app",
        "paths": ["/promo/*", "/product/*"]
      }
    ]
  }
}
    assetlinks.json
    [
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.app",
      "sha256_cert_fingerprints": [
        "14:6D:E9:01:07:52:07:71:..."
      ]
    }
  }
]

    The Complete Guide to iOS Universal Links & Android App Links

    In modern mobile growth and omnichannel attribution, Universal Links (iOS) and App Links (Android) represent the gold standard for routing mobile web visitors seamlessly into native apps. Unlike legacy custom URI schemes (such as spotify://track/...), Universal Links and App Links rely on cryptographic domain association files hosted over HTTPS to verify that only authorized apps can handle URLs for a specific domain.

    🍎iOS Universal Links Architecture

    Hosted at https://domain.com/.well-known/apple-app-site-association. Apple devices fetch this file either via Apple's CDN cache (iOS 14+) or directly upon app installation to map HTTP(S) paths to your Apple Team ID and Bundle Identifier.

    🤖Android App Links Architecture

    Hosted at https://domain.com/.well-known/assetlinks.json. Android OS queries this file during app install to verify that your app's signing keystore SHA-256 fingerprint matches the domain, bypassing the generic Android "Open with..." app picker dialog.

    Top 5 Reasons Universal Links & App Links Fail in Production

    1. HTTP Redirects on Association Files: Both Apple and Google strictly require that the AASA and assetlinks files return an exact HTTP 200 OK response. If your Nginx/Cloudflare server redirects http:// to https:// or enforces trailing slashes, domain verification will fail silently.
    2. Incorrect Content-Type Headers: Apple expects application/json or application/pkcs7-mime, while Google rejects files not served with Content-Type: application/json. Serving the file as text/html or text/plain causes mobile OS parsers to reject the association.
    3. Apple CDN Caching Delays: Since iOS 14, Apple routes all AASA requests through their centralized CDN (app-site-association.cdn-apple.com). When you update your AASA file on your server, Apple's CDN may take 24 to 72 hours to refresh its cache.
    4. Mismatched App ID / Team ID Prefix: An iOS App ID consists of a 10-character Apple Developer Team ID followed by a period and the Bundle ID (e.g. 9JA89QQLNQ.com.company.app). Omitting the Team ID or introducing a typo breaks Universal Link registration.
    5. Invalid SHA-256 Fingerprints in Android: Android App Links require the release signing key's SHA-256 fingerprint, formatted as 32 hex pairs separated by colons. If you use Google Play App Signing, you must use the App Signing certificate fingerprint from Google Play Console, not your local debug upload keystore.

    How to Host and Serve Association Files Flawlessly

    Ensure your web server configuration includes the following HTTP response headers for all requests targeting the /.well-known/ directory:

    # Nginx configuration example
    location /.well-known/apple-app-site-association {
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    }

    location /.well-known/assetlinks.json {
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    }