AASA File Validator

The file must be served from /.well-known/apple-app-site-association (Apple also accepts the domain root as a fallback), over HTTPS with a valid certificate, and without any redirects. Crucially, the filename has no .json extension — a surprising number of setups fail because a web server or CDN only serves the file as apple-app-site-association.json. The response should carry a Content-Type of application/json, and the file must stay under 128 KB.

Since iOS 14, devices no longer fetch your AASA file directly: Apple’s CDN retrieves it and delivers a cached copy when the app is installed. That means a fix you deploy today may not reach test devices immediately, and a server that blocks Apple’s CDN user agent will break universal links even though the file looks perfect in your own browser.

The applinks section declares which URLs open your app. The modern format (iOS 13+) uses a details array where each entry lists appIDs plus a components array of path, query, and fragment patterns — including exclusion rules with "exclude": true. The legacy format with a top-level apps array and paths strings still works, but components gives far finer control, such as matching only /product/* URLs while excluding /product/legacy/*.

The webcredentials section powers password autofill and passkeys: it simply lists the appIDs allowed to share credentials with the domain. The appclips section lists App Clip identifiers (note the .Clip suffix on the bundle ID). Each section is independent — a valid applinks block does not make password autofill or App Clips work if the other sections are missing or malformed.