what is assetlinks.json

DrupalVIP Support

assetlinks.json is a crucial file used in the Digital Asset Links protocol, primarily by Android devices, to establish a secure and verifiable association between a website and its corresponding Android app.

Here's a breakdown of what it is and why it matters:

What it is:

  • It's a JSON (JavaScript Object Notation) file that you host on your website.
  • It's always located at a specific, well-known path: https://yourdomain.com/.well-known/assetlinks.json. The .well-known directory is a standardized location for site-wide metadata.
  • The file contains "statements" that declare a relationship between your website and your Android app(s).

What its purpose is (and why it matters):

The main purpose of assetlinks.json is to enable Android App Links. This allows for a seamless user experience where clicking a link to your website directly opens the corresponding content within your Android app, rather than opening it in a web browser. 

Here's how it works and its benefits:

  1. Verification of Ownership: When an Android device encounters a URL that your app claims to handle, it checks your website for the assetlinks.json file. 
    This file contains information about your app, including its package_name and the SHA256 fingerprints of its signing certificate. 
    By successfully verifying this file, the Android system confirms that you, as the website owner, have authorized that specific app to handle links for your domain. 
    This prevents malicious apps from claiming to handle your website's links. 

  2. Seamless User Experience (Android App Links):

    • Bypassing the Disambiguation Dialog: Without assetlinks.json and proper setup, if a user clicks a link that could be opened by both a browser and your app, they'd typically see a "disambiguation dialog" asking them to choose which application to use. 
      With assetlinks.json, if the verification is successful, the link will automatically open in your app (if installed), providing a much smoother and faster user experience.
    • Direct Content Access: Users are taken directly to the specific content within your app that corresponds to the clicked URL. 
      This is especially useful for deep linking scenarios like email verification links, password reset links, or links to specific product pages.
       

  3. Security: By requiring the assetlinks.json file to be hosted on your domain and validated against your app's signing certificate, the Digital Asset Links protocol adds a layer of security, ensuring that only trusted applications can handle your website's links.

  4. Google Search Integration: Android App Links also enable better integration with Google Search. 
    Users can directly open content in your app from Google Search results in a mobile browser, the Google Search app, or through Google Assistant.
     

Key considerations for assetlinks.json:

  • HTTPS Required: The assetlinks.json file must be served over HTTPS.
  • Content-Type: application/json: The server must return this content type for the file.
  • No Redirects: The file must be accessible directly without any HTTP redirects (301 or 302).
  • Multiple Domains/Subdomains: If your app supports links from multiple domains or subdomains, you need to publish a valid assetlinks.json file on each of them.
  • SHA256 Fingerprint: The sha256_cert_fingerprints in the assetlinks.json file must match the signing certificate of your Android app. 
    If you use Google Play App Signing, you can get the correct snippet from your Google Play Console.
     

In essence, assetlinks.json is a vital component for any Android app that wants to provide a truly integrated and seamless experience for users interacting with its associated website.