Free tool
AASA & assetlinks.json generator
Fill in your apps and get both files for Universal Links and App Links: apple-app-site-association and assetlinks.json, with the hosting steps and the app-side snippets. Runs in your browser, no sign-up.
The domain your links use, like links.yourapp.com. It goes in the hosting steps and the app snippets; the files themselves don't contain it.
🍎 iOS: apple-app-site-association
For Universal Links. Add every app that should open the links, including staging builds you test with.
apple-app-site-association
https://yourdomain.com/.well-known/apple-app-site-association
No .json extension. If your browser adds one to the download, remove it.
🤖 Android: assetlinks.json
For App Links. One entry per package, with the SHA-256 of every key that signs a build you install.
Using Play App Signing? Google re-signs your app, so the key on your laptop isn't the one users install. Add the app signing key's SHA-256 from Play Console → App integrity → App signing, plus your upload and debug keys if you install those builds too.
Local keys: ./gradlew signingReport
assetlinks.json
https://yourdomain.com/.well-known/assetlinks.json
Upload them
Put both files at exactly these addresses:
- https://yourdomain.com/.well-known/apple-app-site-association
- https://yourdomain.com/.well-known/assetlinks.json
- HTTPS with a valid certificate, HTTP 200, and Content-Type: application/json — set it explicitly for the iOS file, since it has no extension.
- No redirects: not http to https, not the bare domain to www. Google doesn't follow redirects, so Android won't verify; Apple asks for the file without redirects too. Exempt /.well-known/ from the redirect.
- On every host your app lists. If people share links on both www and the bare domain too, host both files there as well and list both hosts in the app.
- Reachable by crawlers: bot protection or geo-blocking can stop Apple's CDN or Google's verifier while your browser loads the file fine.
- Changes take time. Apple's CDN fetches the iOS file within about 24 hours, and devices check for updates about once a week. Android verifies when the app is installed or updated; while testing, run
adb shell pm verify-app-links --re-verify com.example.app.
After you deploy: want HTTP 200, application/json, no location header
curl -sI https://yourdomain.com/.well-known/apple-app-site-association curl -sI https://yourdomain.com/.well-known/assetlinks.json
Check after you upload
The validator reads both files the way Apple and Google do, including Apple's CDN copy. The tester shows where a link opens in Instagram, WhatsApp and Chrome.
The link holds your IDs and fingerprints, which are public anyway: they're in the files you host.
How it works
Two small files that let your domain open your app.
Fill in your apps
Team ID and bundle ID for iOS, package name and SHA-256 fingerprints for Android, and the paths that should open the app.
Download both files
apple-app-site-association and assetlinks.json update as you type. Copy them, or download with the exact file names.
Upload and check
Host them at /.well-known/ on your domain with the steps shown, add the app-side snippets, then run the validator.
Skip the hosting
CodeOnAir serves both files for you.
With CodeOnAir AppLinks you enter your Team ID, bundle ID, package name and fingerprints once, and we build and serve apple-app-site-association and assetlinks.json on every link domain: your free yourapp.codeonair.com subdomain, or your own domain with the custom domain add-on. Links you set to open in the browser on iOS are excluded in the file for you.
The dashboard shows the Associated Domains entry and intent filter for your domains, checks the files the way phones do, and adds deferred deep linking, store fallbacks and analytics. The Free plan includes 100 app links.
Questions
Where do I upload apple-app-site-association and assetlinks.json?
At https://yourdomain/.well-known/apple-app-site-association and https://yourdomain/.well-known/assetlinks.json, on every host your app lists. Serve them over HTTPS with HTTP 200, Content-Type application/json and no redirects. The iOS file has no .json extension.
Which SHA-256 fingerprint goes in assetlinks.json?
The fingerprint of the certificate that signed the build on the phone. With Play App Signing, Google re-signs your app, so copy the app signing key's SHA-256 from Play Console under App integrity. Add your upload and debug keys too if you install those builds. List all of them; it's one list per package.
What's the difference between components and paths in the AASA file?
components is the current format (iOS 13 and later): each rule can match the path, the query and the fragment, and can exclude links. paths is the older format for iOS 12 and earlier, which matches the path only. Turn on iOS 12 support only if you still need it.
Do I need the files on both www and the bare domain?
Only if your app lists both hosts, but if people share links both ways, you should. Each host is checked at its own /.well-known/ address, and Google doesn't follow a redirect from one to the other, so a link to the bare domain won't open the app on Android.
I uploaded the file but links still open Safari.
Devices read the iOS file from Apple's CDN, which fetches it within about 24 hours, and installed apps check for updates about once a week. Check your domain with the validator to see the CDN's copy. Also make sure the app has the applinks: entry in Associated Domains, and tap the link rather than pasting it into the address bar.
Is anything I type sent to CodeOnAir?
No. The files are built in your browser. The share link keeps the form in the page address, and nothing in it is secret: Team IDs, bundle IDs, package names and certificate fingerprints are all public in the files you host.
Going deeper: the apple-app-site-association and assetlinks.json setup guide, and what to check when Universal Links don't work or App Links don't verify.
Your first AppLink in five minutes.
Create an app, pick a subdomain, and share a link that opens your app. Try Growth free for 30 days — no card needed.