---
title: "Open links in your phone apps · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses/app-links
id: WEB-178
level: Recommended
applies: mobile
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1019
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Open links in your phone apps

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: WEB-178
- Level: Recommended
- Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md)
- Rule: If you ship an iOS or Android app, publish `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json`, so links to your site open in the app.
- Check: `curl https://app-site-association.cdn-apple.com/a/v1/example.com` returns your current file. Google's Digital Asset Links API lists the app for the site. A link to a listed path opens the app on iOS and on Android.
- Applies when: The project ships an iOS or Android app.
- How: Serve both as `application/json`, over HTTPS, without a redirect. The Apple file has no file ending and lists the app IDs and the paths the app handles. Apple fetches it through its own CDN within 24 hours, and devices check for updates about once a week. The Android file gives the package name and the SHA-256 fingerprint of the signing certificate. With Play App Signing, use the fingerprint Google Play shows, not your upload key. Links that carry tokens or open account screens must use these verified links, as [Open deep links only from verified domains](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/verified-deep-links.md) requires. Push taps use the same links, as [Open the exact page the push is about](https://agentwranglers.se/playbook/notifications/web-push/push-deep-links.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "applinks": {
    "details": [
      { "appIDs": ["ABCDE12345.com.example.app"], "components": [{ "/": "/orders/*" }] }
    ]
  }
}
```

### Shell example

```sh
curl 'https://digitalassetlinks.googleapis.com/v1/statements:list?source.web.site=https://example.com&relation=delegate_permission/common.handle_all_urls'
```

### JSON example 2

```json
[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.example.app",
    "sha256_cert_fingerprints": ["14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5"]
  }
}]
```

## Sources

- [Apple: Supporting associated domains](https://developer.apple.com/documentation/xcode/supporting-associated-domains)
- [Google Digital Asset Links (Getting started)](https://developers.google.com/digital-asset-links/v1/getting-started)

## Related rules

- WEB-168 [Serve standard files at fixed addresses](https://agentwranglers.se/playbook/website/standard-addresses/well-known-overview.md) in Website
- MOB-44 [Open deep links only from verified domains](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/verified-deep-links.md) in Mobile apps
- NTF-15 [Open the exact page the push is about](https://agentwranglers.se/playbook/notifications/web-push/push-deep-links.md) in Notifications

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/website/standard-addresses/app-links">Agent Wranglers website playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [List your APIs in one file](https://agentwranglers.se/playbook/website/standard-addresses/api-catalog.md)
- Next: [Tell people how to report a hole](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md)
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md)