Deep linking should be simple: a user clicks a link, the app opens to the right screen. In practice, it is one of the most fragile parts of mobile development. In-app browsers block Universal Links. Android manufacturers override App Links behavior. Deferred deep links lose context across app store redirects. This guide covers the most common challenges and practical solutions.<\/p>\n\n\n\n
For a comprehensive overview of deep linking, see the complete guide to deep linking in 2026<\/a>. For the standards that govern these challenges, see deep linking standards in 2026: what has changed<\/a>.<\/p>\n\n\n\n When a user clicks a link in Facebook, Instagram, Twitter\/X, LinkedIn, or other social apps, the link opens in an in-app browser (a WebView) instead of the system browser. Apple's Universal Links<\/a> require the system to intercept the navigation, which does not happen inside a WebView.<\/p>\n\n\n\n Result: the user sees your website instead of your app.<\/p>\n\n\n\n Use a bounce page<\/strong> strategy. Instead of linking directly to your Universal Link domain, link to a page that:<\/p>\n\n\n\n On iOS, the bounce page can use Universal Links require an Common errors:<\/p>\n\n\n\n Validate both files regularly:<\/p>\n\n\n\n Set up automated monitoring to catch regressions:<\/p>\n\n\n\n Custom URL schemes (e.g., Use Universal Links<\/a> (iOS) and App Links<\/a> (Android) instead. These use standard HTTPS URLs with domain verification, provide automatic web fallback, and cannot be hijacked by other apps.<\/p>\n\n\n\n Keep custom URL schemes only for:<\/p>\n\n\n\n For a detailed comparison, see the custom URL schemes guide<\/a>.<\/p>\n\n\n\n A deferred deep link needs to survive the user journey: click link, go to app store, install app, open app. The original link context (which product, which campaign, which referrer) must be available after install. This requires matching the click to the install, which is inherently imprecise.<\/p>\n\n\n\n Common failures:<\/p>\n\n\n\n Use multiple matching strategies in order of reliability:<\/p>\n\n\n\n The key is combining methods and accepting that deferred deep links will not match 100% of the time.<\/p>\n\n\n\n Android's open ecosystem means manufacturers can modify deep link behavior. Samsung, Xiaomi, Huawei, Oppo, and others each have their own browser, link handler, and battery optimization that can interfere with App Links.<\/p>\n\n\n\n1. In-App Browsers Block Universal Links<\/h2>\n\n\n\n
The Problem<\/h3>\n\n\n\n
The Solution<\/h3>\n\n\n\n
\n
function handleBounce(req: Request, res: Response) {\n const ua = req.headers['user-agent'] || '';\n const isInAppBrowser = \/FBAN|FBAV|Instagram|Twitter|LinkedIn\/i.test(ua);\n\n if (isInAppBrowser) {\n \/\/ Render a page with a button that opens the system browser\n res.render('bounce', {\n appLink: `https:\/\/app.example.com${req.path}`,\n message: 'Tap to open in the app'\n });\n } else {\n \/\/ Redirect to the Universal Link\n res.redirect(`https:\/\/app.example.com${req.path}`);\n }\n}\n<\/code><\/pre>\n\n\n\nwindow.open()<\/code> or a user-initiated tap to break out of the in-app browser. On Android, the page can use an Intent URL<\/a> as a fallback.<\/p>\n\n\n\n2. AASA and assetlinks.json Misconfiguration<\/h2>\n\n\n\n
The Problem<\/h3>\n\n\n\n
apple-app-site-association<\/code> (AASA) file at \/.well-known\/apple-app-site-association<\/code>. App Links require an assetlinks.json<\/code> file at \/.well-known\/assetlinks.json<\/code>. If these files have errors, deep links silently fail and the user sees the website.<\/p>\n\n\n\n\n
content-type<\/code> header (must be application\/json<\/code>).<\/li>\n\/.well-known\/<\/code> path (Apple and Google do not follow redirects for verification).<\/li>\nThe Solution<\/h3>\n\n\n\n
# Check AASA\ncurl -sI https:\/\/yourdomain.com\/.well-known\/apple-app-site-association | grep -i content-type\n# Should return: content-type: application\/json\n\n# Check assetlinks.json\ncurl -s https:\/\/yourdomain.com\/.well-known\/assetlinks.json | python3 -m json.tool\n# Should be valid JSON with correct package name and fingerprints\n\n# Use Apple's validator\n# https:\/\/search.developer.apple.com\/appsearch-validation-tool\/\n\n# Use Google's validator\n# https:\/\/developers.google.com\/digital-asset-links\/tools\/generator\n<\/code><\/pre>\n\n\n\nasync function checkVerificationFiles() {\n \/\/ Check AASA\n const aasa = await fetch('https:\/\/yourdomain.com\/.well-known\/apple-app-site-association');\n if (aasa.status !== 200) {\n alert('AASA file returned non-200 status');\n }\n const contentType = aasa.headers.get('content-type');\n if (!contentType?.includes('application\/json')) {\n alert(`AASA wrong content-type: ${contentType}`);\n }\n\n \/\/ Check assetlinks.json\n const assets = await fetch('https:\/\/yourdomain.com\/.well-known\/assetlinks.json');\n if (assets.status !== 200) {\n alert('assetlinks.json returned non-200 status');\n }\n}\n<\/code><\/pre>\n\n\n\n3. Custom URL Schemes Are Unreliable<\/h2>\n\n\n\n
The Problem<\/h3>\n\n\n\n
myapp:\/\/products\/123<\/code>) were the original deep linking mechanism. They have fundamental flaws:<\/p>\n\n\n\n\n
myapp:\/\/<\/code>, the behavior is undefined.<\/li>\nThe Solution<\/h3>\n\n\n\n
\n
4. Deferred Deep Links Lose Context<\/h2>\n\n\n\n
The Problem<\/h3>\n\n\n\n
\n
The Solution<\/h3>\n\n\n\n
\n
5. Android Manufacturer Fragmentation<\/h2>\n\n\n\n
The Problem<\/h3>\n\n\n\n