Public links should be HTTPS
The safest public links are normal HTTPS URLs on your own domain. If the app is installed and platform association is configured, the operating system can open the app. If it is not installed, the same URL still loads a useful web page.
Store links need device detection
A generic Download button should send iPhone and iPad users to the App Store, Android users to Google Play, and desktop users to a page with both badges. Keep this logic simple and visible.
Deferred deep linking is a separate decision
If you need attribution across install, campaign routing, or invite recovery after install, choose a dedicated deep-linking provider. Do not rely on deprecated link products or custom schemes for core acquisition flows.
Test before review
Test the association files on the exact production domain, with the exact app identifiers and release signing certificate fingerprints. Development domains and placeholder fingerprints will not verify.