Association studio · identity before routing
A valid file is only one side of the trust handshake.
The website, signed app, system verifier, and URL policy must agree. This studio builds the local evidence and simulates ordered Apple rules without pretending it can certify your production host or device cache.
Two-sided trust handshake
TEAM ID + BUNDLE ID
associated-domains entitlement
HTTPS ORIGIN
AASA or assetlinks at exact path
PACKAGE + SHA-256
manifest intent filter + installed signer
Identity rails
ABCDE12345.com.example.appTeam ID prefixes bundle ID
com.example.appapplication ID
AA:BB:…:32 BYTESinstalled certificate fingerprint
PLAY CERTIFICATEoften differs from local upload key
Ordered route court
/private/*EXCLUDEfirst match stops/products/*INCLUDEpath evidence/search/* + queryINCLUDEpath and query/help/* + fragmentEXCLUDEfragment evidence*INCLUDEfallbackPlatform divergence map
Production hosting runway
/.well-known/apple-app-site-associationHTTPS · no extension · JSON MIME · no redirect/.well-known/assetlinks.jsonHTTPS · application/json · no redirectseparate origin evidencesubdomain and apex verify independentlyApple CDN / device verifierdeployment is not immediate local state128 KB uncompressedkeep rules conciseFailure ladder
file unreachable or redirected
wrong MIME or malformed JSON
app ID/package/signer mismatch
entitlement or manifest missing
ordered rule does not match
install/cache/browser behavior
Security perimeter
Routed parameters remain untrusted input.
Association proves control relationships, not authorization. Validate and normalize the URL, require authentication, check resource ownership, confirm destructive actions, and preserve a safe web fallback.