Deep Linking in Android WebView: URI Schemes, App Links, and Intent Filters

A comprehensive developer guide to configuring custom URI schemes, Android App Links, digital asset links, and seamless routing from social media, emails, and QR codes.

1. The Three Tiers of Android Deep Linking

In modern mobile app architecture, deep linking allows external sources—such as marketing emails, SMS messages, QR codes, and search engine results—to launch your application and navigate directly to a specific product, article, or user profile rather than opening the generic home screen.

Android supports three distinct tiers of deep linking:

• Custom URI Schemes (e.g. myapp://product/123): Simple custom protocols configured in the manifest. While widely supported, they trigger disambiguation popups if multiple apps register the same scheme.
• Standard Web Deep Links (HTTP/HTTPS): Standard URLs that present the Android “Open with” app chooser dialog.
• Android App Links (Verified HTTPS): The gold standard of deep linking. By hosting an encrypted assetlinks.json file on your domain, Android automatically opens your verified app without displaying any chooser dialog.

2. Configuring Intent Filters in AndroidManifest.xml

To register your application as an authorized handler for your web domain, an <intent-filter> with the android:autoVerify="true" attribute is declared in the manifest:

<activity android:name=".MainActivity" android:exported="true">
    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:scheme="https" android:host="yourwebsite.com" />
    </intent-filter>
</activity>

3. Generating the Digital Asset Links (assetlinks.json)

To verify ownership of your domain and prevent third-party apps from hijacking your URLs, Android queries your web server for a Digital Asset Links JSON file at https://yourwebsite.com/.well-known/assetlinks.json:

[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.yourbrand.app",
    "sha256_cert_fingerprints": [
      "14:6D:E9:7D:0F:52:CC:E5:43:7E:09:94:1B:51:AD:80:E6:EA:4F:8B:35:D3:B4:85:07:7E:83:F0:1C:4E:91:B2"
    ]
  }
}]

FreeWebAPK automatically extracts your package name and SHA-256 fingerprint, providing you with the exact JSON code ready to upload to your server’s .well-known directory.

4. Routing Incoming URLs Inside Android WebView

When a user clicks a link and launches your app, the Android Activity captures the incoming Intent URI and routes it to the WebView:

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);
    
    Intent intent = getIntent();
    Uri data = intent.getData();
    if (data != null) {
        // Load deep link URL directly inside WebView
        webView.loadUrl(data.toString());
    } else {
        webView.loadUrl("https://yourwebsite.com");
    }
}

5. Comparison of Deep Linking Technologies

6. Summary: Delivering Seamless Cross-Platform Journeys

Deep linking connects your web presence, email marketing, and mobile app into a unified user journey. FreeWebAPK equips your application with native intent filter support so your audience experiences smooth, uninterrupted navigation every time.

5. Android App Links vs Custom URI Schemes

There are two distinct forms of deep linking on Android:

Android App Links represent the gold standard: because domain ownership is cryptographically verified via your website’s assetlinks.json file, Android opens your app immediately without ever prompting the user with an “Open with Chrome or App?” disambiguation dialog.

6. Testing Deep Link Routing via Android Debug Bridge (ADB)

To test whether your application routes incoming deep links correctly without sending actual push messages, use the adb command line:

adb shell am start -a android.intent.action.VIEW \
  -c android.intent.category.BROWSABLE \
  -d "https://yourdomain.com/product/ultra-wireless-headphones" \
  com.yourapp.package

Observe your application launch and verify that the target product page renders smoothly in the WebView.

7. Handling Instagram, TikTok & WhatsApp In-App Browsers

When users tap links inside Instagram or WhatsApp, those apps launch an internal mini-browser that ignores standard deep link routing. Implement smart deep link intent tags (intent://...#Intent;scheme=https;package=...;end) on your landing pages to break out of social in-app browsers and redirect directly to your installed Android app.

8. Production Diagnostics: Debugging assetlinks.json & Intent Verification

Troubleshoot deep link failures with precision using Android’s built-in package manager commands:

• Verification State Inspection: Run adb shell pm get-app-links com.yourapp.package in your terminal. If the output displays legacy_failure or verified: false, inspect your assetlinks.json syntax for missing commas, incorrect SHA-256 certificate hashes, or redirect headers.
• Handling Query Parameters in WebView: Ensure your native intent router passes the full URL string including query parameters (e.g. ?ref=email&promo=vip) to the WebView, allowing your web application to handle referral attribution and coupon pre-filling.

9. Attribution & Campaign Performance Tracking

Deep linking unlocks powerful mobile campaign attribution. By appending UTM parameters (utm_source, utm_medium, utm_campaign) to your deep links in marketing emails, SMS blasts, and social media ads, your analytics dashboards can accurately attribute installs and revenue to specific promotional campaigns.

10. Deep Linking & App Links Verification Checklist

11. Case Study: Slashing Referral Drop-Off with Verified App Links

12. Production Code: Handling Deep Link Intents in MainActivity

Parse and route incoming deep link URLs inside your native Android activity:

class MainActivity : AppCompatActivity() {
    private lateinit var webView: WebView

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)
        webView = findViewById(R.id.webView)
        
        handleIncomingDeepLink(intent)
    }

    override fun onNewIntent(intent: Intent) {
        super.onNewIntent(intent)
        setIntent(intent)
        handleIncomingDeepLink(intent)
    }

    private fun handleIncomingDeepLink(intent: Intent?) {
        val appLinkData: Uri? = intent?.data
        if (appLinkData != null) {
            val destinationUrl = appLinkData.toString()
            Log.d("DeepLink", "Navigating to deep link: " + destinationUrl)
            webView.loadUrl(destinationUrl)
        } else {
            webView.loadUrl("https://yourdomain.com")
        }
    }
}

Handling onNewIntent ensures that tapping a link while the app is already open navigates immediately without reloading the entire app.

13. Deep Linking Strategic Summary & Marketing ROI

14. Digital Asset Links Cryptographic Handshake Architecture

The security and speed of Android App Links depend on Google’s automated cryptographic verification during app installation:

Once verified, the Android OS bypasses the browser entirely, routing all link clicks originating in emails, text messages, or third-party apps directly to your native app container in under 50 milliseconds.

Frequently Asked Questions

What happens if someone clicks an Android App Link but doesn’t have the app installed?

Because Android App Links use standard HTTPS URLs (e.g. https://yourwebsite.com/article), users without the app seamlessly open the link in their mobile browser with zero broken links or errors.

Where do I host the assetlinks.json file on my website?

You must host it at ‘https://yourdomain.com/.well-known/assetlinks.json’ served with Content-Type: application/json and accessible via HTTPS without redirects.

How does Android verify my assetlinks.json file?

When a user installs your app from Google Play, the Android operating system automatically makes an HTTPS request to your domain’s /.well-known/assetlinks.json file to verify that the SHA-256 fingerprint matches your installed app.

Can I deep link into specific products or blog posts?

Yes! Any valid URL on your website will open directly to that specific page inside the WebView container.

Does FreeWebAPK configure deep links automatically?

Yes. When you enter your website URL in the FreeWebAPK generator, the compiler automatically injects the matching intent-filter and autoVerify declarations into the AndroidManifest.xml.

Where must the assetlinks.json file be hosted?

It must be accessible over HTTPS at exactly ‘https://yourdomain.com/.well-known/assetlinks.json’ with content-type ‘application/json’ and return HTTP 200 without redirects.

Does deep linking work if the app is completely closed?

Yes! Android’s activity manager handles launching cold application instances and delivers the deep link intent data to your onCreate() lifecycle method.

How do I verify assetlinks.json using Google’s official tool?

Use Google’s Digital Asset Links API: visit ‘https://digitalassetlinks.googleapis.com/v1/statements:list?source.web.site=https://yourdomain.com&relation=delegate_permission/common.handle_all_urls’ to see automated validation status.

Can deep links open specific tabs in my bottom navigation bar?

Yes! Your web application can inspect window.location.pathname upon loading and programmatically activate the corresponding tab.

Can deep links open private in-app shopping carts with items pre-filled?

Yes! By passing a session token or cart ID in the deep link URL, your web application can restore and pre-fill the customer’s cart upon launch.