What is Deep Link?
Also called universal link, app link, deferred deep link.
A deep link is a URL that opens a specific location inside an application rather than its default entry screen. Implementations range from custom URL schemes to verified web links that open the app when installed and the website otherwise. Deep links are how a conversation hands the user to the exact record, screen, or thread being discussed.
Three mechanisms are common. Custom schemes register a protocol handler owned by the app, which is simple but fails silently when the app is absent and can be claimed by more than one application. Verified web links, known as universal links on Apple platforms and app links on Android, associate a domain with an app through a file hosted on that domain, so a normal https URL opens the app when installed and the web page otherwise.
Deferred deep linking handles the case where the app is not yet installed. The link stores the intended destination, sends the user to the store, and restores the destination on first launch. This improves continuity but relies on matching a pre-install click to a post-install session, and the reliability of those matching techniques has declined as platforms restricted cross-context identifiers.
Security requires treating the link target as untrusted input. A deep link can be crafted by anyone, so the receiving screen must authenticate the user, authorize access to the referenced object, and validate parameters before acting. Sensitive identifiers should not be embedded where they will be logged or shared, and destructive actions should not be reachable from a link without confirmation.
In agent contexts deep links close the loop between a message and the interface. A notification about a new document, an approval, or a conversation is far more useful when tapping it lands on that exact item, and channels differ in how they preview and rewrite links, which affects whether the target opens as expected.
Key points
- Opens a specific in-app destination instead of the home screen
- Verified web links fall back to the site when the app is absent
- Deferred links restore the destination after installation
- Link parameters are untrusted; authorize before acting
- Turns a notification into a one-tap route to the item
In practice
An assistant finishes drafting a contract and sends a chat message with a link to that document. On a phone with the app installed, the verified link opens the app directly on the draft. On a laptop it opens the same document in a browser. The receiving screen checks the signed-in user's access to that workspace before rendering, so a forwarded link does not expose the file.