Generate assetlinks.json

Enter your package name and the SHA-256 fingerprint of your signing certificate. The assetlinks.json file updates as you type, ready to copy or download.

Your file

Serve it over HTTPS at the .well-known address, with no redirect.

assetlinks.json

https://links.example.com/.well-known/assetlinks.json (Serve over HTTPS with Content-Type application/json and no redirect.)

[
  {
    "relation": [
      "delegate_permission/common.handle_all_urls"
    ],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.app",
      "sha256_cert_fingerprints": [
        "14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5"
      ]
    }
  }
]

Deploy it, then validate

Upload the file to the address above, then check what a client reads from your domain.

Validate links.example.com Run the full deep link check

How it works

Enter your domain and package: Use the applicationId from your Gradle file, for example com.acme.app.
Add your certificate fingerprints: Paste each SHA-256 value on the line under its package. We accept it with or without colons, in any letter case, and format it.
Copy or download: The file is named assetlinks.json. Serve it at the .well-known address shown above it.
Add the intent filter: In your manifest, add an intent filter with android:autoVerify="true" for the same host.
Deploy, then validate: Run the assetlinks.json validator on your domain to confirm Android can read it.

Reference

What each field means

Field	What it means
Domain	The host that serves your links, such as links.acme.dev. It sets the address above the file and is not written into the JSON. Use the host from your intent filter.
Package name	The applicationId in your app's Gradle file. It is dot separated words that start with a letter. Put each package on its own line.
SHA-256 certificate fingerprint	The SHA-256 of the certificate that signs the build users install: 32 hex pairs, 64 digits. Run ./gradlew signingReport or keytool -list -v, or read it in Play Console under App integrity.
Play App Signing key and upload key	With Play App Signing, Google re-signs your app, so users install a build signed with the app signing key. Use that key's fingerprint. The upload key is only for sending builds to Play.
get_login_creds	Adds delegate_permission/common.get_login_creds beside handle_all_urls, so the app and the site can share saved passwords. Leave it off for App Links only.

Common mistakes

Mistake	What happens and the fix
The upload key instead of the app signing key	A file with only the upload key fails verification on builds installed from Play. Copy the app signing key certificate from Play Console.
A fingerprint that is not 64 hex digits	SHA-1 is 40 digits and a copy that cuts off a pair is shorter. The generator counts the digits and names the length it found.
A redirect in front of the file	A redirect from http, from the bare domain or to www fails verification. Serve it with a 200 on the exact host.
A wrong content type	Return Content-Type application/json. A page served as text/html or a download is not read as JSON.
A debug build that is not listed	Builds you run from Android Studio are signed with your debug key. Add its fingerprint as well while you test, and remove it before you ship if you want a stricter file.
A host missing from the intent filter	Android verifies each host in your autoVerify intent filters. A host without a file on it keeps the links in the browser.

What goes in assetlinks.json

Android checks this file before it lets your app open links to your domain. Each statement names your package and the SHA-256 fingerprint of the certificate that signs the build, using the delegate_permission/common.handle_all_urls relation.

The file does not set URL paths. The intent filters in your app manifest decide which paths your app handles, and the file proves your domain trusts the app. Serve it at /.well-known/assetlinks.json over HTTPS with no redirect.

The generator writes one statement for each package and lists every fingerprint you add under it. The output is plain JSON with a fixed key order, so the same input always gives the same file.

Frequently asked questions

Where do I find the SHA-256 fingerprint?

Run keytool -list -v against your keystore, or run ./gradlew signingReport. In Play Console, open App integrity and copy the app signing key certificate. Copy the SHA-256 line.

Which signing key should I use?

Use the key that signs the build the user installs. With Play App Signing, that is the app signing key from Play Console, not the upload key. Add your debug or upload key as well while you test.

Can I add two fingerprints?

Yes. List every certificate that may sign a build you want verified, for example the release key and a debug key. The generator writes them into one statement for the package.

Can one file cover several apps?

Yes. Add each package name on its own line with its fingerprints below it. The file gets one statement per package.

Does assetlinks.json set URL paths?

No. Paths come from the intent filters in your AndroidManifest.xml. The file only connects your domain to your package and certificate.

Where must I host it?

At https://your-domain/.well-known/assetlinks.json on each host in your intent filters. It needs a 200 response over HTTPS, a JSON content type and no redirect.

Is anything I enter sent to a server?

No. The file is built in your browser as you type. The page address updates with your entries, so you can bookmark or share the result.

Related tools

We host this file for you

Register your app in WarpLink and we generate, serve and update your assetlinks.json file. You never hand-edit JSON or redeploy a server to change a fingerprint.

Start buildingFree to start. No sales call.