App Links on Android, step by step

# Debug
keytool -list -v -keystore ~/.android/debug.keystore \
  -alias androiddebugkey -storepass android | grep SHA256

# Your release keystore
keytool -list -v -keystore /path/to/release.jks -alias your-alias | grep SHA256

<activity
    android:name=".MainActivity"
    android:exported="true"
    android:launchMode="singleTop">

    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:scheme="https"
              android:host="links.example.com"
              android:pathPrefix="/l/" />
    </intent-filter>

    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
</activity>

<uses-permission android:name="android.permission.INTERNET" />

import androidx.lifecycle.lifecycleScope
import kotlinx.coroutines.launch

class MainActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)
        handleIntent(intent)                    // cold start
    }

    override fun onNewIntent(intent: Intent) {
        super.onNewIntent(intent)
        setIntent(intent)                       // keep getIntent() in sync
        handleIntent(intent)                    // already running
    }

    private fun handleIntent(intent: Intent?) {
        if (intent?.action != Intent.ACTION_VIEW) return
        val uri = intent.data ?: return
        lifecycleScope.launch {
            val path = EdokLinks.resolve(uri)
            if (path != null) route(path) // else: stay on the current screen
        }
    }
}

import android.net.Uri
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.withContext
import org.json.JSONObject
import java.net.HttpURLConnection
import java.net.URL

object EdokLinks {

    private const val TIMEOUT_MS = 4_000

    /**
     * Returns the in-app path for [url], or null if it cannot be resolved.
     * Never throws — a link tap needs an answer or a null.
     */
    suspend fun resolve(url: Uri): String? = withContext(Dispatchers.IO) {
        var connection: HttpURLConnection? = null
        try {
            connection = (URL(url.toString()).openConnection() as HttpURLConnection).apply {
                requestMethod = "GET"
                setRequestProperty("Accept", "application/json")
                // A 3xx means we were answered as a browser. That response has
                // no destination in it, so following it is a wasted request.
                instanceFollowRedirects = false
                connectTimeout = TIMEOUT_MS
                readTimeout = TIMEOUT_MS
            }

            if (connection.responseCode != 200) return@withContext null

            val contentType = connection.contentType ?: ""
            if (!contentType.contains("json")) return@withContext null

            val body = connection.inputStream.bufferedReader().use { it.readText() }
            val json = JSONObject(body)

            // matched:false is the normal answer for a slug that is unknown,
            // switched off, or deleted. A link can outlive whoever shared it.
            if (!json.optBoolean("matched", false)) return@withContext null

            json.optString("deepLinkPath").takeIf { it.isNotEmpty() }
        } catch (_: Exception) {
            // No connectivity, DNS failure, TLS error, a captive portal serving
            // HTML — all of it must land the user in the app, never on a crash.
            null
        } finally {
            connection?.disconnect()
        }
    }
}

{ "matched": true,  "linkId": 12452, "slug": "spring-sale", "deepLinkPath": "/product/123" }
{ "matched": false, "linkId": null,  "slug": null,          "deepLinkPath": null }

private fun route(path: String) {
    // Treat path as untrusted input: match it against routes you know rather
    // than passing segments straight into a query.
    val segments = path.trim('/').split('/')
    when {
        segments.size == 2 && segments[0] == "product" ->
            startActivity(Intent(this, ProductActivity::class.java)
                .putExtra("id", segments[1]))
        else -> Unit   // unknown route: stay where you are
    }
}

implementation("com.android.installreferrer:installreferrer:2.2")

import android.content.Context
import com.android.installreferrer.api.InstallReferrerClient
import com.android.installreferrer.api.InstallReferrerStateListener
import kotlinx.coroutines.CoroutineScope
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.launch

/** Call once, on the first run after install. */
fun claimInstall(context: Context, onResolved: (String?) -> Unit) {
    val prefs = context.getSharedPreferences("edok", Context.MODE_PRIVATE)
    if (prefs.getBoolean("install_claimed", false)) return

    val client = InstallReferrerClient.newBuilder(context).build()
    client.startConnection(object : InstallReferrerStateListener {
        override fun onInstallReferrerSetupFinished(responseCode: Int) {
            prefs.edit().putBoolean("install_claimed", true).apply()
            if (responseCode != InstallReferrerClient.InstallReferrerResponse.OK) return

            // getInstallReferrer throws RemoteException if the service died
            // between connecting and reading.
            val referrer = try {
                client.installReferrer.installReferrer   // "edok_link=AbC123..."
            } catch (_: Exception) {
                null
            } finally {
                client.endConnection()
            }
            if (referrer.isNullOrEmpty()) return

            CoroutineScope(Dispatchers.IO).launch {
                onResolved(EdokLinks.claimInstall(referrer))
            }
        }

        override fun onInstallReferrerServiceDisconnected() {}
    })
}

suspend fun claimInstall(referrer: String): String? = withContext(Dispatchers.IO) {
    var connection: HttpURLConnection? = null
    try {
        val endpoint = URL("https://admin.edokstudio.com/api/public/links/claim-install")
        connection = (endpoint.openConnection() as HttpURLConnection).apply {
            requestMethod = "POST"
            doOutput = true
            setRequestProperty("Content-Type", "application/json")
            connectTimeout = TIMEOUT_MS
            readTimeout = TIMEOUT_MS
        }
        connection.outputStream.use {
            it.write(JSONObject().put("referrer", referrer).toString().toByteArray())
        }

        if (connection.responseCode != 200) return@withContext null
        val json = JSONObject(connection.inputStream.bufferedReader().use { it.readText() })
        if (!json.optBoolean("matched", false)) return@withContext null
        json.optString("deepLinkPath").takeIf { it.isNotEmpty() }
    } catch (_: Exception) {
        null
    } finally {
        connection?.disconnect()
    }
}

GET https://links.example.com/l/<slug>
Accept: application/json

{ "matched": true,  "linkId": 12452, "slug": "spring-sale", "deepLinkPath": "/product/123" }
{ "matched": false, "linkId": null,  "slug": null,          "deepLinkPath": null }

POST https://admin.edokstudio.com/api/public/links/claim-install
Content-Type: application/json

{ "referrer": "<the full Play install referrer string>" }

GET https://links.example.com/.well-known/assetlinks.json

Dashboard:  Opens in the app  →  /product/123
Resolve:    {"matched": true, "deepLinkPath": "/product/123"}
Your code:  route("/product/123")  →  ProductActivity, id = "123"

# Is the domain verified on this device?
adb shell pm get-app-links com.example.app

# Fire a link
adb shell am start -a android.intent.action.VIEW \
  -c android.intent.category.BROWSABLE \
  -d "https://links.example.com/l/your-slug"

Domain verification state:
  links.example.com: verified

adb shell pm set-app-links-user-selection --user cur \
  --package com.example.app true links.example.com

curl "https://digitalassetlinks.googleapis.com/v1/statements:list?\
source.web.site=https://links.example.com&\
relation=delegate_permission/common.handle_all_urls"