SDK-Free Deep Linking

Deep Linking for iOS and Android, Without an SDK

Universal Links and App Links are features of iOS and Android, not features of a vendor. The operating system decides whether a URL opens your app by reading two files hosted on the link domain — no third-party library is involved in that decision. DeepTap hosts those files, routes the click, and returns deferred link context after install. Nothing enters your dependency graph, and there is no SDK to re-integrate when the platforms change.

Check your Universal Links for free (no sign-up)

Published 2026-08-26 · Last updated 2026-08-26

How do Universal Links and App Links work?

Both platforms decide whether an ordinary HTTPS URL belongs to your app by reading a file from the link domain. On iOS it is /.well-known/apple-app-site-association, listing the app IDs allowed to handle your URLs and which paths they claim. On Android it is /.well-known/assetlinks.json, listing your package name and release signing fingerprints. Serve those correctly and deep linking works. Serve them wrong and it fails — usually silently.

Two details are worth getting right, because most articles on this topic get them wrong.

iOS does not fetch the file on every tap.Since iOS 14, Apple's CDN retrieves it when your app is installed or updated, and the device uses the cached result. That is good for speed, but it means a malformed file, a redirect, or a wrong content type produces no visible error: Universal Links simply stop opening your app for everyone who installed during that window, and you may not find out for days.

The file does not need to be cryptographically signed. Apple dropped that requirement years ago, back in the iOS 9.3 era. What it does need is HTTPS, a JSON content type, no redirects, and no authentication.

Android verifies its file at install and update time too, which is why changes there can take a while to propagate to devices that already have your app.

You can check any domain right now with our free AASA validator — no sign-up, and it works whether or not you use DeepTap.

What "SDK-free" does and does not mean

It means no vendor library in your binary and nothing added to your dependency graph. Direct deep linking genuinely involves no DeepTap code — a tap resolves through the operating system. Deferred deep linking is the one exception, and it is a single HTTPS call rather than a library.

We would rather be precise about that than sell a slogan. On first launch your app calls /api/deferred-link and receives the saved path and query parameters — roughly fifteen lines with URLSession or OkHttp. Compare that with an SDK, which is a versioned third-party dependency inside your binary that you re-integrate on someone else's schedule.

Ready-to-paste code for each platform is in the iOS, Android, React Native and Flutter guides.

What DeepTap does, and what it doesn't

It does

• Host and serve your iOS and Android association files
• Route each click to the app or to the right store
• Match a deferred link to the install after the fact
• Branded short links, with per-plan limits
• URL patterns and exclude patterns per domain
• Click analytics, including app-versus-store outcome
• A public REST API with an OpenAPI 3.1 spec
• A hosted MCP server, so a coding agent can set it up

It does not

• Ad attribution or multi-touch modelling
• In-app event tracking
• Ad-fraud detection
• Cross-device identity resolution
• Retargeting audiences or re-engagement segments
• Web-to-app banners or interstitial campaigns
• Integrations with marketing clouds and ad networks

Everything in the right-hand column needs code running inside your app, which is precisely what SDK-free rules out. If you need those, a measurement platform is the correct tool — see AppsFlyer vs Branch for how the two main ones compare.

What setup involves

Pick a subdomain

Something like myapp.deeptap.io. There is no DNS to configure — we host it, certificates included. Custom branded domains on your own hostname are available on the Pro plan.

Enter your app credentials

Bundle ID and Team ID for iOS, package name and SHA-256 release signing fingerprints for Android. Your association files are generated and served from those.

Configure the native side

An associated-domains entitlement in Xcode, an intent filter with autoVerify in your Android manifest, and your existing routing code reading the incoming URL. This step is required by every option on the market, SDK platforms included — it is how iOS and Android work.

Verify before you ship

Validate the association file, then test on real devices. A wrong content type or a redirect makes Universal Links fail without any error message, so checking is not optional.

Or let your coding agent do it

DeepTap ships a hosted MCP server with OAuth 2.1 authentication, so Claude Code, Codex or Claude Desktop can create the domain, set your credentials and verify the result without you editing config by hand. MCP setup guide

An honest note on deferred deep linking accuracy

DeepTap matches a click to an install using a server-side fingerprint built from the client IP and the device platform, within a short window after the click — the same SDK-free approach the big platforms use as their fallback. It is most reliable when the click and the first app launch happen on the same network. Behind CGNAT, a VPN, or iCloud Private Relay, or when the device changes network between click and launch, the match can fail: your app still opens, just without the saved deep-link context. No fingerprint method avoids this entirely without an SDK in your app, which is the trade we deliberately do not make. We also do not publish a headline match-rate percentage — anyone quoting you one number is guessing, and the real figure depends on your traffic.

Pricing you can read without a sales call

$5.99, $14.99 or $49.99 per month, differing by number of domains, active short links and analytics retention. Per plan, not per install or per tracked user — so the bill does not spike when a campaign works.

See all plans →

Frequently asked questions

What does SDK-free deep linking actually mean?

It means no vendor library is added to your app and nothing enters your dependency graph. Direct deep linking involves no vendor code at all — iOS Universal Links and Android App Links are operating-system features, and the OS performs the routing by reading two files hosted on the link domain. A deep-link host serves those files correctly and routes the click. The one place it is not literally zero code is deferred deep linking, which needs a single HTTPS call on first launch.

How does deferred deep linking work without an SDK?

When someone clicks a link without your app installed, DeepTap stores the destination and sends them to the App Store or Google Play. On first launch your app makes one HTTPS GET to /api/deferred-link and receives the saved path and query parameters. That is roughly fifteen lines using your platform standard networking — URLSession on iOS, OkHttp on Android — with no library to update when the OS changes.

How accurate is the match?

DeepTap matches a click to an install using a server-side fingerprint of the client IP and the device platform, within a short window after the click. It is most reliable when the click and the first launch happen on the same network, and it degrades behind CGNAT, VPNs, iCloud Private Relay, or a network change between the two. When it misses, the link still opens your app — just on the default screen rather than the intended one, so design that fallback deliberately. We do not publish a single match-rate figure because the honest answer depends entirely on your traffic mix.

What does DeepTap not do?

Ad attribution, in-app event tracking, fraud detection, cross-device identity resolution, retargeting audiences, and marketing-stack integrations. All of those need code running inside your app, which is exactly what SDK-free rules out. If attribution is what you need, a measurement platform is the right tool and we will say so.

What analytics do you get without an SDK?

Click volume over time, device and platform breakdown, referrer, and the metric that matters most for deep links: whether each click opened the app or fell through to the store. Analytics retention depends on plan — 7 days on Basic, 30 on Indie, unlimited on Pro. This is link reporting, not campaign attribution, and it is deliberately not sold as attribution.

Do I need to configure DNS?

Not for the default setup. You pick a subdomain such as myapp.deeptap.io and DeepTap hosts it, including certificates and the association files. Custom branded domains on your own hostname are available on the Pro plan. What you do configure, on every option including the SDK platforms, is the native side: an associated-domains entitlement in Xcode and an intent filter in your Android manifest.

What happens to existing users if the hosting has an outage?

Since iOS 14, Apple fetches your association file through its own CDN when your app is installed or updated, not on every tap, and the device uses the cached result. Android verifies at install and update time as well. So an outage does not break deep linking for people who already have your app; it affects verification for new installs and updates during the window. That is true of any hosted deep-link infrastructure, SDK-based or not.

How much does it cost?

$5.99, $14.99, or $49.99 per month, differing by number of domains, active short links, and analytics retention, with a 7-day free trial. Pricing is per plan rather than per install or per tracked user, so it does not spike when a campaign works.

Try it without adding anything to your app

Seven-day free trial, then $5.99/month. Direct deep linking needs no DeepTap code at all — you can have it working before you decide.

Read the implementation guides