---
title: "Network, links and web views · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views
parts: 4
tokens_total: 3937
updated: 2026-10-27
build: a2a6bdfed830
tokens: 661
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Network, links and web views

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Mobile apps](https://agentwranglers.se/playbook/mobile-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Traffic, sign-in and links cross from the app to the outside world. Use TLS, the system browser for sign-in, verified links and locked web views.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- MOB-43 [Sign in through the system browser with PKCE](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/system-browser-sign-in.md) · 1,067 tokens · updated 2026-10-27
  Run OAuth and OpenID Connect sign-in in the system browser session, never in a web view inside the app. Every request uses PKCE, and the redirect goes to a claimed https address.
- MOB-44 [Open deep links only from verified domains](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/verified-deep-links.md) · 1,070 tokens · updated 2026-10-27
  Links that open screens or carry tokens use verified Universal Links and Android App Links on https addresses you own. The app checks every link parameter against an allowlist before acting on it.
- MOB-45 [Allow no cleartext traffic from the app](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/no-cleartext-traffic.md) · 872 tokens · updated 2026-10-22
  Release builds send every request over TLS and trust only the system certificate authorities. They carry no global App Transport Security exception and no Android cleartext permission.

## Recommended

- MOB-46 [Keep web views to your own pages](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/locked-web-views.md) · 928 tokens · updated 2026-10-27
  A web view inside the app loads only pages from an allowlist of your own https origins. Bridges from JavaScript to native code are present only while one of those pages is loaded.

- Previous: [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device.md)
- Next: [Privacy declarations](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations.md)
- [All chapters](https://agentwranglers.se/playbook/mobile-apps.md)