Deep Linking in Mobile Apps: URL Scheme and Universal Links
A deep link doesn't open—users see an empty browser instead of the desired app screen. Or it opens but passes parameters in an encoding the app fails to parse. This is classic when first implementing a URL scheme. In one project with a large user base, we found that 20% of deep links were lost due to incorrect parameter handling in the URL—costing the business 15% of conversions. With extensive experience, we have developed methods that guarantee correct deep link operation in 99% of cases. Certified engineers (iOS, Android, Flutter) set up schemes in a short timeframe. Contact us for a consultation on your project—we can help you with deep links. According to Apple Developer Documentation, Universal Links require a correct AASA file. Implementing Universal Links in a large-scale project reduced conversion losses by 20%.
Why Universal Links Are More Secure Than Custom URL Scheme
Custom URL Scheme (myapp://product/123) is easy to implement but insecure: any app can register the same scheme and intercept the deep link. It is suitable for internal navigation between own apps or for dev tools. Universal Links (iOS) and App Links (Android) work through an HTTPS domain with verification files (apple-app-site-association / assetlinks.json). They are secure and fall back to the browser if the app is not installed. This is the right approach for production. In practice, we implement both: Universal Links as the primary mechanism, Custom URL Scheme as a fallback when domain verification is not possible. According to tests, Universal Links cause errors three times less frequently on cold start compared to Custom URL Scheme.
| Characteristic | Custom URL Scheme | Universal Links / App Links |
|---|---|---|
| Security | Low (interception) | High (verification) |
| Fallback | Does not open | Opens in browser |
| Complexity | Simple | Medium (domain required) |
| Reliability | ~85% successful opens | >98% successful opens (with correct setup) |
How to Configure Deep Links on iOS and Android
iOS (Swift/SwiftUI): Register the scheme in Info.plist under CFBundleURLTypes, handle it in application(_:open:options:) for UIKit or via .onOpenURL in SwiftUI. For Universal Links, use application(_:continue:restorationHandler:). Parse the URL using URLComponents, not manual string splitting. In configuration, specify the domains in Associated Domains in Xcode.
Android (Kotlin): In AndroidManifest.xml, add an <intent-filter> with <data android:scheme="myapp"/>, handle intent.data in the Activity. For App Links, add android:autoVerify="true" and upload assetlinks.json to https://domain.com/.well-known/. Ensure the server returns 200 and the correct Content-Type.
| Component | iOS | Android |
|---|---|---|
| Verification | AASA file via HTTPS | assetlinks.json via HTTPS |
| Handling | application(_:continue:) | Intent.data with autoVerify |
| Fallback | Redirect to website | Open in browser |
| Typical error | Cache delay up to 24 hours | Incorrect app signature |
Cross-Platform Frameworks
React Native: Use the Linking API from react-native core, and for navigation, @react-navigation/native with the linking config. A common mistake is forgetting to handle the case when the app was closed (cold start) vs already running (foreground). These are different events. Additionally, check the scheme settings in Info.plist and AndroidManifest.
Flutter: The go_router package supports deep links natively; you only need to configure routerConfig with GoRouter and add configuration in native modules via flutter_deeplinking_enabled in Info.plist/manifest. Alternatively, use the app_links package.
Common Testing Mistakes
Deep links are often tested only through Safari/Chrome, but the case where the app is installed but closed is forgotten. On iOS with Universal Links, there can be a delay in AASA file verification on first launch—the app opens via browser instead of the deep link, and the team thinks something is broken. This is normal behavior; the cache updates within 24 hours. On Android, ensure that assetlinks.json returns 200 and the JSON is valid. Another common issue is using HTTP instead of HTTPS: according to App Store Review Guidelines, all deep links must be HTTPS. As a result, about 10% of all failures are related to HTTP redirects.
| Problem | Cause | Solution |
|---|---|---|
| Deep link doesn't open on cold start | Only foreground handling | Implement handling in AppDelegate/Application for cold start |
| Parameters passed with errors | Using manual string split | Use URLComponents/URI for parsing |
| Universal Link doesn't work on iOS | AASA verification delay | Wait up to 24 hours, check SSL certificate |
What Our Work Includes
- Audit of the current deep linking scheme
- Design of the target architecture (URL scheme, Universal/App Links)
- Implementation on the chosen stack (iOS/Android/Flutter/React Native)
- Configuration of verification files on the server
- Testing scenarios: cold start, foreground, background
- Integration with analytics (Firebase, AppsFlyer)
- Documentation and developer training
Case Study: 30% of Errors Caught During Testing
One project was an e-commerce app with a large user base. After implementing Universal Links, we discovered 30% of cold-start failures due to incorrect parameter handling in AppDelegate. After fixing, conversion to the target screen increased by 15%. We guarantee such issues will be eliminated during the audit phase.Service Timeline and Pricing
The timeline ranges from 1 to 2 weeks depending on the complexity of the ecosystem and the need for cross-platform support. The exact cost is determined after a thorough analysis of the current scheme and requirements. We do not offer fixed prices—each project is unique. Contact us for a deep linking audit and get a ready configuration in a short timeframe. Get a consultation—we will show you implementation examples for your stack.