HTTPS Scheme Fails for Android App Links on Samsung Android Devices Within Auth0

Samsung Android devices experience a Not found page error after migrating to Android App Links. Resolve this issue by configuring Auth0 and the Android application to fall back to a custom Uniform Resource Identifier (URI) scheme.

Not found

• Android
• Samsung Android Devices
• Kotlin Software Development Kit (SDK) 
• Auth0

The issue may be specific to the Samsung device only or a more general issue in Android devices. Often, devices in power-saving mode randomly fail to fetch the public keys from the asset link (for example, https://<example.us.auth0.com>/.well-known/assetlinks.json). This failure causes App Links to malfunction, even when the application code and Auth0 settings are configured according to the recommendations.

Reinstalling the application sometimes resolves the issue.

How is the Not found page error resolved after migrating to Android App Links on Samsung Android devices?

NOTE: Auth0 strongly recommends using only HTTPS-based callbacks with Android App Links and Apple Universal Links whenever possible. If business requirements mandate supporting devices that don't support HTTPS-based callback URLs, a fallback to a custom scheme may be necessary. 

Configure Auth0 for both schemes, update the Android manifest, and implement runtime verification logic in the application code to fall back to a custom URI scheme.

1. In the Auth0 Dashboard, add both the App Link and the Custom Scheme to the Allowed Callback URLs and Allowed Logout URLs fields.
   • https://EXAMPLE_TENANT.auth0.com/android/EXAMPLE_PACKAGE/callback
   • myapp://EXAMPLE_TENANT.auth0.com/android/EXAMPLE_PACKAGE/callback
2. Open the AndroidManifest.xml file and declare intent filters for both schemes so the application handles either option. Use the following code as an example based on the callback URLs provided in the previous step.

   <activity
       android:name=".MainActivity"
       android:exported="true"
       android:launchMode="singleTask">
   
       <!-- App Link (HTTPS) with auto-verify -->
       <intent-filter android:autoVerify="true">
           <action android:name="android.intent.action.VIEW" />
           <category android:name="android.intent.category.DEFAULT" />
           <category android:name="android.intent.category.BROWSABLE" />
           <data
               android:scheme="https"
               android:host="${auth0Domain}"
               android:pathPrefix="/android/${applicationId}/callback" />
       </intent-filter>
   
       <!-- Custom Scheme Fallback -->
       <intent-filter>
           <action android:name="android.intent.action.VIEW" />
           <category android:name="android.intent.category.DEFAULT" />
           <category android:name="android.intent.category.BROWSABLE" />
           <data
               android:scheme="myapp"
               android:host="${auth0Domain}"
               android:pathPrefix="/android/${applicationId}/callback" />
       </intent-filter>
   </activity>

3. Implement runtime verification logic so the application uses the Android DomainVerificationManager to check the domain status when the end-user selects the Log In button. The following Kotlin code can be used as a starting point.

   import android.content.Context
   import android.content.pm.verify.domain.DomainVerificationManager
   import android.content.pm.verify.domain.DomainVerificationUserState
   import android.os.Build
   import com.auth0.android.Auth0
   import com.auth0.android.authentication.AuthenticationException
   import com.auth0.android.callback.Callback
   import com.auth0.android.provider.WebAuthProvider
   import com.auth0.android.result.Credentials
   
   class Auth0LoginHelper(
       private val context: Context,
       private val account: Auth0
   ) {
       companion object {
           private const val FALLBACK_SCHEME = "myapp"
           private const val SECURE_SCHEME = "https"
       }
   
       fun startLogin(callback: Callback<Credentials, AuthenticationException>) {
           val selectedScheme = determineScheme()
           
           WebAuthProvider.login(account)
               .withScheme(selectedScheme)
               .start(context, callback)
       }
   
       fun startLogout(callback: Callback<Void?, AuthenticationException>) {
           val selectedScheme = determineScheme()
           
           WebAuthProvider.logout(account)
               .withScheme(selectedScheme)
               .start(context, callback)
       }
   
       private fun determineScheme(): String {
           // Android 12+ is where Samsung/OEM issues are most prevalent
           if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
               return checkDomainVerification()
           }
           
           // Pre-Android 12: App Links generally work, but you could 
           // also default to custom scheme for maximum compatibility
           return SECURE_SCHEME
       }
   
       private fun checkDomainVerification(): String {
           return try {
               val manager = context.getSystemService(DomainVerificationManager::class.java)
               val userState = manager.getDomainVerificationUserState(context.packageName)
               
               val auth0Domain = account.getDomain() // Use SDK's domain getter
               val domainState = userState?.hostToStateMap?.get(auth0Domain)
   
               when (domainState) {
                   DomainVerificationUserState.DOMAIN_STATE_VERIFIED -> {
                       // Fully verified by OS
                       SECURE_SCHEME
                   }
                   DomainVerificationUserState.DOMAIN_STATE_SELECTED -> {
                       // User manually approved in settings
                       SECURE_SCHEME
                   }
                   DomainVerificationUserState.DOMAIN_STATE_NONE -> {
                       // Not verified — fall back
                       FALLBACK_SCHEME
                   }
                   else -> SECURE_SCHEME
               }
           } catch (e: Exception) {
               // Safety net: if anything fails, use secure scheme
               SECURE_SCHEME
           }
       }
   }

NOTE: This solution won't work if the browser blocks the redirect to the application. One known use case is the Firefox browser in Android applications. Firefox doesn't redirect to applications by default and requires users to enable a setting to open links in native application.