Android association workflow
Android App Links: prepare and publish assetlinks.json
An assetlinks.json file declares which app a website associates with. Generating the file is one step: publishing it, configuring the app and verifying the association are separate tasks.
Content updated: · Maintained by Hung Chi-Hsueh · corrections
Prepare the app identity
Find the application ID for the build you intend to distribute and the SHA-256 fingerprint of its signing certificate. Obtain fingerprints yourself in a trusted environment; do not provide a private key. With Google Play App Signing, use the app signing certificate fingerprint used for distributed apps, not the upload key fingerprint. The Android documentation identifies the Play Console app signing page and its Digital Asset Links snippet.
In this generator, the application ID must have at least two dot-separated segments, each starting with an ASCII letter and continuing with ASCII letters, digits or underscores; the total limit is 255 characters. Enter at most eight fingerprints, one per line: each is 64 hexadecimal characters or 32 colon-separated hexadecimal pairs. These are tool input limits, not proof that the identity belongs to you.
Choose only the intended relationship
Open the generator, enter the application ID and fingerprints, then review the resulting statement and download it. The handle_all_urls relation declares that the app may handle URLs for the website; actual handling also depends on app configuration and Android verification.
The optional get_login_creds relation declares a credential-sharing relationship. Enable it only when you intend to authorize credential sharing and understand its scope: Google Password Manager treats sharing relationships as transitive. The generated app statement alone is not a complete credential-sharing setup; follow Google's instructions for the website and app.
Preserve existing statements before publishing
The downloaded file covers only the app in this operation. It does not automatically merge an existing file. Before publishing, inspect the current statement list and manually merge and review the new statement, preserving other apps, statements and Android 15 dynamic path rules and their relation extensions. Do not overwrite the existing file with the download without this review.
For each hostname explicitly listed in App Links intent filters, publish the reviewed JSON at https://HOST/.well-known/assetlinks.json. It must be publicly accessible over HTTPS, return Content-Type: application/json, and not redirect. Individual subdomains are separate. For a wildcard host such as *.example.com, Android requires the file at the root hostname example.com. For credential sharing, publish a valid assetlinks.json on each subdomain the app interacts with; follow the credential-sharing setup for the complete relationship.
Configure and verify on Android
Configure the app manifest's App Links intent filter for the intended hosts and URLs. After deployment, independently inspect each live HTTPS response and use Android's App Links verification procedures on a real Android platform with the intended signed app. If verification fails, check the application ID, signing fingerprint, host, response content type, redirects and manifest filter against the official guide.
The generator and JSON format checks do not verify a signature, identity, domain ownership, network connection or App Links association. They do not contact the website or upload a private key. A valid-looking file or successful download is not evidence that Android verified the deployed association.
Data provenance