ZipQuantum Support

ZipQuantum serves a Digital Asset Links response on an accepted redirect host when the production Android package and at least one SHA-256 signing-certificate fingerprint are configured on the server.

The supported URL is /.well-known/assetlinks.json. If the package or fingerprint list is missing, the endpoint intentionally returns 404.

Required Values

• The exact production Smart Link host.
• The Android application ID or package name.
• The SHA-256 fingerprint of the certificate that signs the installed production build.
• Every additional valid production fingerprint when key rotation or multiple release identities are supported.

What ZipQuantum Publishes

The generated assetlinks.json grants delegate_permission/common.handle_all_urls to the configured package and fingerprint list. These values are production server settings, not client dashboard fields.

Android Manifest

1. Add an intent filter to the activity that receives links.
2. Use the VIEW action and the DEFAULT and BROWSABLE categories.
3. Set android:autoVerify="true".
4. Declare the HTTPS scheme and the exact production host.
5. Route the incoming URI path and approved parameters to the intended screen.

<intent-filter android:autoVerify="true">
  <action android:name="android.intent.action.VIEW" />
  <category android:name="android.intent.category.DEFAULT" />
  <category android:name="android.intent.category.BROWSABLE" />
  <data android:scheme="https" android:host="your-production-host" />
</intent-filter>

Configure the Smart Link

1. Open the link in Links.
2. Set Android package to the exact application ID.
3. Set Fallback URL when you need a destination other than the automatically constructed Google Play listing.
4. Save the link.

When the visitor is on Android and a package is configured, ZipQuantum can build the Android intent. If no explicit fallback URL is set, it uses the Google Play URL derived from the package.

Verify Domain Association

adb shell pm set-app-links --package YOUR_PACKAGE 0 all
adb shell pm verify-app-links --re-verify YOUR_PACKAGE
adb shell pm get-app-links YOUR_PACKAGE

Wait for the asynchronous verification result and confirm that the production host is reported as verified.

Deferred Recovery

Android deferred recovery uses an opaque Play Install Referrer token. The app submits that token to the public recovery endpoint and receives the original link context after validation. Routing does not require fingerprinting; optional device context remains separate and consent-controlled.

Troubleshooting

• The association endpoint returns 404: the package or production certificate fingerprints are not configured on the server.
• Verification fails: compare the manifest host, package name, and production signing fingerprint with the JSON response.
• Play App Signing is enabled: use the certificate fingerprint distributed by Google Play, not merely a local upload key.
• The browser opens: confirm autoVerify, HTTPS, the exact host, and a fresh installation or forced re-verification.
• The wrong store or page opens: verify the per-link Android package and fallback URL.