How do you implement deep links for iOS and Android?

A deep link is a URL that opens a specific screen. Custom schemes are easy but can be claimed by other apps. Verified HTTPS links are more secure because the OS checks that your app is authorised for the domain. iOS calls these Universal Links and Android calls them App Links.

final router = GoRouter(
  routes: [
    GoRoute(
      path: '/orders/:id',
      builder: (context, state) {
        final id = state.pathParameters['id'];
        if (id == null) return const NotFoundPage();
        return OrderPage(orderId: id);
      },
    ),
  ],
);

• iOS needs Associated Domains entitlement and an apple-app-site-association file served over HTTPS
• Android needs intent filters and a Digital Asset Links file with the signing certificate fingerprint
• Route every screen from identifiers so a link works without in-memory state
• Handle the initial link on cold start and subsequent links while running
• Provide a web fallback for users without the app and a clear error for invalid links

Security and testing

Treat every path and query parameter as untrusted. Validate ids, reject unexpected hosts and avoid open redirects that forward to arbitrary URLs. Test links from a messaging app, a browser and a terminated state, because each launch path can behave differently. Verify production signing fingerprints, not only debug ones.