vela_links 0.1.2

Deep links, app links, deferred deep links, short links, share links, QR codes and link tracking for Flutter. A Firebase Dynamic Links alternative.

vela_links

Deep links, app links (Android App Links and iOS Universal Links), deferred deep links, short share links, QR codes and link tracking for Flutter apps, powered by the Vela Links service. A link opens the right screen in your app, even when the app is not installed yet. It is a simple alternative to Firebase Dynamic Links and Branch.

Features

• Deep links and app links: open a screen in your app from a web link, a QR code or a custom scheme.
• Deferred deep links: a person who installs the app from a link lands on the right screen at first launch.
• Short share links: create links from inside the app and share them anywhere.
• QR codes: every app gets a trackable QR code, and any link can be shown as a QR code.
• Link tracking: see taps, QR scans, installs and opens per link in the dashboard.

1. Set up your app in the dashboard

Sign up at https://deeplinks.velaapps.in (there is a free plan to try it), add your app (package name, signing fingerprint, Apple Team ID, store links) and copy the SDK key. The dashboard shows the exact Android and iOS settings for your app.

2. Install

flutter pub add vela_links

3. Use

import 'package:vela_links/vela_links.dart';

await VelaLinks.init(
  apiKey: 'vl_...',
  baseUrl: 'https://api.links.velaapps.in',
  slug: 'your-app-slug', // optional: ignore links that belong to another app
);

// A link opened your app (or matched your first launch after install)
VelaLinks.instance.onLink.listen((link) {
  // link.route, link.params, link.deferred
  if (const {'/invite', '/product'}.contains(link.route)) {
    // open that screen; ignore anything you do not expect
  }
});

// Create a short link from inside the app
final url = await VelaLinks.instance.createLink(route: '/invite', params: {'id': '42'});

If a link arrives before you start listening, read it once with VelaLinks.instance.consumePendingLink().

4. Platform setup

• Android: an intent filter for your link domain and your URI scheme (shown in the dashboard), and the Play Install Referrer is read automatically for deferred links.
• iOS: the Associated Domains entitlement applinks:<your link domain> and your URI scheme.

Good to know

• The SDK key identifies your app. It can create links and report opens for that one app, and nothing else. It is meant to live in your app, like an analytics key, so it is rate-limited. Once you save your app's package name or bundle id in the dashboard, the key also stops working from any other app. You can rotate it in the dashboard at any time.
• baseUrl must be https:// (plain http:// only for localhost or the Android emulator 10.0.2.2). The key is sent only to that address, and redirects are never followed.
• Every network step has a time limit (requestTimeout, default 10 seconds). Any failure, whatever its cause (no network, a bad certificate, a timeout), raises VelaLinksException (background work such as reporting opens never raises) and never stops your app starting. createLink throws an ArgumentError for an empty route or params that are not JSON.
• Treat link.route and link.params as untrusted input, like any deep link: check the route against the screens you allow, and never put secrets in link params.
• Call VelaLinks.instance.dispose() to stop listening. Calling init again replaces the previous instance.
• reportOpens: false turns off open and QR-scan reporting.
• Adding the SDK to an app that is already installed: the first-launch check also runs once for people who update. On iOS that can show the paste notice once, and on Android an old install referrer could open an old link. Pass matchDeferred: false in that release, and turn it on in the next one.

Privacy: what the SDK sends

• To the Vela Links service, over https: your SDK key, your app's package name or bundle id, the link code that opened the app, and whether it came from a link or a QR code. When you create a link: the route, params and title you give it.
• First launch after install (it stops after one success, or after 3 launches that could not reach the service): on Android only the Vela Links token from the Play install referrer is read, and nothing else from it. On iOS the clipboard is read once per try, only to look for a Vela Links token (iOS may show its paste notice); the token is cleared once used, and any other clipboard text is ignored and never sent. If there is no token, the service can still match an iOS install to a recent tap using a one-way hash of the network address (it never stores the address itself).
• The SDK uses no advertising id (IDFA/GAID), no device id, no location, and has no native code of its own. It stores two small values on the device (shared preferences): whether the first-launch check is finished, and how many tries it has made.
• Include this in your app's privacy policy and in the App Store and Play Console data forms.

Support and security

Questions: [e-mail]. To report a security problem privately, see SECURITY.md.

License

MIT. See LICENSE.