Deep Link Doctor
Home / Developer notes

App Links fail on Play installs, wrong fingerprint

App Links work on debug but fail from Google Play because assetlinks.json has the upload key. How to get the Play App Signing SHA-256 fingerprint and format it.

SymptomApp Links verify on your debug or sideloaded build but open the browser for users who install from Google Play.
Likely causeassetlinks.json lists the upload or debug key fingerprint, not the Play App Signing key that signs the app users install.
FixCopy the SHA-256 fingerprint of the app signing key from Play Console into sha256_cert_fingerprints.

Short answer: With Play App Signing, Google re-signs your app with its own app signing key. The fingerprint keytool shows for your upload key will "usually not match the one on users' devices". Copy the SHA-256 of the app signing key from Play Console, in colon-separated uppercase hex, into assetlinks.json.

What is happening

sha256_cert_fingerprints: the list of SHA-256 fingerprints of the certificates allowed to sign the app, written as colon-separated uppercase hex strings.

Android compares the fingerprint of the installed app's signing certificate with the list in the file. Google's Play Console help explains two keys:

  • Upload key: "You use this key to sign your app bundle before uploading."
  • App signing key: "Google uses this key to sign the final APKs delivered to users' devices."

If the file holds only the upload or debug fingerprint, Play-installed apps do not match.

Why does this happen?

Developers usually take the fingerprint from their local keystore with keytool, which is the upload or debug key. With Play App Signing enabled, users receive an app signed with Google's app signing key instead.

Format errors are the other cause:

  • SHA-1 instead of SHA-256: a shorter, 20-pair value.
  • Lowercase hex: the Digital Asset Links API rejects values that are not "colon-separated uppercase hex".
  • No colons or extra spaces. A valid SHA-256 value is 32 uppercase hex pairs joined by 31 colons, 95 characters in total.

How to confirm it

  1. Open Play Console > Protected with Play > Play Store distribution > Play app signing, and find the App signing key section. Older Google docs call this Release > Setup > App signing.
  2. Compare that SHA-256 with the value in https://example.com/.well-known/assetlinks.json.
  3. Compare the value in the live file (curl -I https://example.com/.well-known/assetlinks.json shows the headers; fetch the body without -I) with the app signing key in Play Console. It must be 32 uppercase hex pairs joined by colons, not lowercase and not a shorter SHA-1 value.
  4. On a device with the Play build installed, run adb shell pm get-app-links com.example.app and check for verified.

How to fix it

  1. Copy the app signing key's SHA-256 fingerprint from Play Console. Google says the app signing page shows a ready-made Digital Asset Links snippet.
  2. Add it to sha256_cert_fingerprints. Keep your upload or debug fingerprint too if you test sideloaded builds, since the field supports several values.
  3. Use uppercase hex with colons between every pair.
  4. Deploy, then on a test device run adb shell pm set-app-links --package com.example.app 0 all, adb shell pm verify-app-links --re-verify com.example.app, and after a few minutes adb shell pm get-app-links com.example.app.
  5. Check Play Console > Grow > Deep links, which shows deep links and configuration errors.
[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.example",
    "sha256_cert_fingerprints": [
      "14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5"
    ]
  }
}]

For local keys, keytool -list -v -keystore my-release-key.keystore prints the fingerprint. The Android App Links setup guide covers the full flow, including Play App Signing.

FAQ

Common questions

Why does my keytool fingerprint not work?

With Play App Signing, Google says the fingerprint from running keytool locally will usually not match the one on users' devices. Use the app signing key from Play Console instead.

Can I list both the upload key and the app signing key?

Yes. Google says the field supports multiple fingerprints, for example for debug and production builds. Listing both lets sideloaded and Play builds verify.

Does the fingerprint have to be uppercase?

Google's API reference describes it as the uppercase SHA-256 fingerprint, colon-separated, and the API rejects malformed values. Copy it exactly as Play Console shows it.

How long is a valid SHA-256 fingerprint?

SHA-256 is 32 bytes, so the value is 32 hex pairs separated by 31 colons, 95 characters in all. A 20-pair value is SHA-1 and will not work.

What are UTM parameters?

UTM parameters are tags added to the end of a link, such as utm_source and utm_campaign, that tell analytics tools where a visit came from. They let you see which campaign, channel and ad brought each visitor.

Which UTM parameters are required?

Use utm_source, utm_medium and utm_campaign on every campaign link. utm_term and utm_content are optional and help you compare keywords or ad variants.