Where to find your Apple Team ID and Android SHA-256 fingerprint

Two values decide whether a link opens your app or the browser. On iOS it's your Apple Team ID, which goes in the apple-app-site-association file. On Android it's the SHA-256 fingerprint of the key that signs your app, which goes in assetlinks.json. Get either one wrong and everything looks fine, except the link opens a web page.

Here's where to find both, and which one to use when there's more than one.

The short answer

• Apple Team ID: sign in at developer.apple.com/account and open Membership details. It's 10 letters and numbers, such as ABCDE12345.
• Android SHA-256, for an app on Google Play: in Play Console, open your app, find App integrity and then Play app signing, and copy the SHA-256 under App signing key certificate. Not the upload key.
• Android SHA-256, for a key you hold yourself: run keytool -list -v -keystore your-key.jks -alias your-alias and copy the line that starts SHA256:.
• Already have links working on your website? Both values are in the files there: /.well-known/apple-app-site-association and /.well-known/assetlinks.json.

Why links need them

When someone taps a link to your domain, the phone asks the domain whether your app is allowed to open it:

• iOS reads https://yourdomain/.well-known/apple-app-site-association. Your app is listed as TEAMID.bundle.id, for example ABCDE12345.com.example.app.
• Android reads https://yourdomain/.well-known/assetlinks.json. Your app is listed by package name and the SHA-256 fingerprints of its signing certificates.

If the Team ID or fingerprint doesn't match the app on the phone, the phone treats the link as an ordinary web link.

Finding your Apple Team ID

1. The Apple Developer website. Sign in at developer.apple.com/account, then open Membership details. The Team ID is listed there. If you belong to several teams, check you have the right one selected: it has to be the team that publishes the app.

2. Xcode. In your target's Signing & Capabilities tab, the Team menu shows which team signs the app. The ID itself is in the project's build settings as DEVELOPMENT_TEAM, which you can also find by searching the .xcodeproj folder.

3. An existing association file. If your website already opens the app, open https://yourdomain/.well-known/apple-app-site-association in a browser. The part before the first dot in each appIDs entry is the Team ID.

A note on older apps. What Apple checks is the App ID prefix. For almost every app it's the same as the Team ID, but some apps created before 2011 have a different prefix. If yours is that old, use the prefix shown for your App ID under Certificates, Identifiers & Profiles → Identifiers.

Not the Team ID: the App Store ID (the number in your App Store link), the Apple ID used for sign-in, and the Key ID or Issuer ID from App Store Connect API keys. All of these get pasted into the Team ID field by mistake.

Finding your Android SHA-256 fingerprint

First, which key?

Most apps on Google Play use Play App Signing, which has been required for new apps since 2021. With it there are two keys:

• the upload key, which you use to sign builds before uploading;
• the app signing key, which Google uses to sign what people actually install.

App Links check the app on the phone, so the fingerprint you need is the app signing key. Using the upload key is the most common reason App Links work in your own test builds but not for real users.

List more than one fingerprint if you install builds from more than one place:

• the app signing key for anything installed from Google Play;
• your upload key, if testers install builds signed with it directly;
• your debug key, for builds you run from Android Studio.

1. Play Console (for apps on Google Play)

Open your app in Play Console and find App integrity, then Play app signing. Google moves its menus around from time to time, so if you can't see it, search the console for "app signing". Under App signing key certificate, copy the SHA-256 certificate fingerprint. The upload key's fingerprint is shown on the same page, so check which one you copy.

If you use internal app sharing, those builds are signed with a separate key, and its certificate is shown in Play Console too.

2. keytool (for a key you hold)

For a release key in a keystore file:

keytool -list -v -keystore my-release-key.jks -alias my-key-alias

For the default debug key:

keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android

Copy the value on the SHA256: line, not the SHA1: one.

3. Gradle

From your project folder, ./gradlew signingReport prints the SHA-256 for every build variant's signing configuration. It's handy for debug and upload keys, but it doesn't know Google's app signing key.

4. From an APK

apksigner verify --print-certs app.apk prints the certificate digest of a built APK. It shows the value in lowercase without colons, so convert it before you use it.

What the value should look like

A SHA-256 fingerprint is 32 bytes: 64 hex characters, usually written in uppercase pairs separated by colons:

14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5

A value with 20 pairs is a SHA-1 fingerprint, and App Links won't accept it.

The mistakes we see most

1. The upload key instead of the app signing key. Links work for the developer but not for anyone who installed from Google Play.
2. SHA-1 instead of SHA-256. Many older guides and some Firebase screens show SHA-1 first.
3. The App Store ID in the Team ID field. The App Store ID is a long number; the Team ID is 10 characters.
4. The wrong team. Agencies and freelancers often belong to several teams. Use the team that publishes the app.
5. The bundle ID or package name doesn't match exactly. com.example.App and com.example.app are different.

Check it

Once your files are live, the free AASA validator and assetlinks.json validator fetch them the way phones do, and say whether your app is listed correctly. If you don't have the files yet, the AASA generator and assetlinks.json generator build them from these values. The assetlinks generator accepts a fingerprint in any format and fixes it.

Where DL2App fits

DL2App hosts both files on your link domain, so you only need the two values, not a web server. Paste your App Store or Google Play link when you start: if your website already publishes the Team ID or fingerprint, we read them from there and fill them in. Links work straight away, sending people to the right store, and once the Team ID and fingerprint are in, they open the app for people who already have it. The files are checked on a schedule, and you get an email if one stops matching. See how it works and pricing.

Questions people ask

Where do I find my Apple Team ID? Sign in at developer.apple.com/account and open Membership details. It's a 10-character code of letters and numbers. In Xcode, it's the DEVELOPMENT_TEAM build setting.

Which SHA-256 fingerprint do I use for App Links? The one for the key that signed the app on the phone. For apps installed from Google Play with Play App Signing, that's the app signing key shown in Play Console, not your upload key. Add the upload and debug keys too if you test builds signed with them.

Can I use a SHA-1 fingerprint in assetlinks.json? No. Android App Links need the SHA-256 fingerprint, which is 64 hex characters.

Is the Team ID the same as the App ID prefix? For almost every app, yes. Some apps created before 2011 have a different App ID prefix, and that prefix is what goes in the association file.

Why do my links work on my phone but not for users? Usually because your phone runs a build signed with your upload or debug key, while users have the build Google signed. Add the app signing key's SHA-256 from Play Console.