Universal Links and Associated Domains App Review checklist

Map every URL to an app state

List marketing links, password reset links, email verification links, invite links, content links, checkout return links, support links, and App Clip routes. Each URL should have an expected app destination, web fallback, signed-out behavior, and expired-token behavior.

Do not test only the happy path from Safari. Reviewers may open links from Mail, Messages, Notes, QR codes, or App Store metadata. The route should land on the same user-understandable state.

Verify domain association and AASA deployment

• Associated Domains entitlement should include the exact production domains.
• The apple-app-site-association file should be reachable over HTTPS without redirects that break validation.
• Path patterns should be narrow enough to avoid taking over unrelated website URLs.
• Staging domains should not appear in production metadata or Review Notes unless intentionally used for testing.
• Domain ownership changes should trigger a release checklist review.

Design fallback states before review

If the app is not installed, the web page should explain the action or offer a download path. If the user is signed out, the app should preserve the intended destination after authentication. If the link is expired, the error should be specific enough for support.

AppReviewReady interpretation: a Universal Link failure often looks like an App Review access failure. Include at least one direct route in Review Notes when a link-dependent feature is central to testing.

Run a route-state matrix

1. Open each URL from a fresh install, existing install, signed-out state, signed-in state, and deleted account state.
2. Test wrong device, wrong region, expired token, revoked invite, and no-network states.
3. Confirm the route respects account permissions and does not reveal private content before auth.
4. Check analytics attribution without storing sensitive link tokens.
5. Retest after website routing, CDN, or domain certificate changes.

Give review a link verification note

Keep the note short and route-specific. A reviewer should not need to debug associated domains to reach the feature being reviewed.

After release, monitor link failures separately from ordinary page views. A broken Universal Link can look like a conversion drop, password-reset failure, invite failure, or checkout return problem depending on the route.

For paid flows, test the link after payment, after cancellation, and after the session expires.

Universal Link review route:
Domain: [domain]
Example URL: [URL]
Expected app screen: [screen]
Signed-out behavior: [login then return]
Expired behavior: [message]
Web fallback: [URL behavior]
AASA last verified: [date]