Associated Domains webcredentials works with ?mode=developer but fails without it - AASA correctly configured

Thanks for the post.

When you use ?mode=developer, you are instructing the Shared Web Credentials on iOS to bypass Apple’s CDN entirely and fetch the Apple App Site Association (AASA) file directly from your origin server. It also bypasses the device's local cache.

In production and without the ?mode=developer the device only fetches the AASA file from Apple's CDN during app installation or when the app is updated. If you installed the app before the AASA file was perfectly configured on the CDN, your device has a cached "failure" state.

Apple's servers scrape your domain asynchronously. If your AASA file was missing, had a JSON syntax error, was served with the wrong content-type, or was behind a redirect when Apple first scraped it, the CDN caches that failure.

So please can you provide me a url to your AASA file as one to the Apple CDN? Even thought I can guess your Apple CDN after you provide me a link to your AASA file.

Even if the CDN shows the correct data now, your local test device won't fetch it again unless forced to if was not the first time you have and you have been using the developer mode. You do not necessarily have to delete and reinstall, but you must at least update the app by incrementing the app's build number. The system otherwise will stay using the developer mode. For a quick test, delete the app and reinstall it without a developer mode.

When an existing user downloads your app update from the App Store, the iOS installation process automatically triggers a fresh request to Apple's CDN to fetch the latest AASA file for your domain. There is a delay entirely on the device side because the device does not poll the CDN on a regular basis.

So please remove ?mode=developer from your entitlements. Increment your build number. Push a build to TestFlight or install via Xcode over an existing build without deleting it.

Albert  WWDR

Thank you. Please find the url https://app-site-association.cdn-apple.com/a/v1/auth.fiixstg.com

I currently verifying on a staging build version.

Thanks for providing this. I see your AASA file is cached by the CDN server. Do you see the same thing?

curl -v https://app-site-association.cdn-apple.com/a/v1/auth.fiixstg.com
* Host app-site-association.cdn-apple.com:443 was resolved.
* IPv6: 2620:149:a0c:f000::9, 2620:149:a00:f000::154, 2620:149:a21:f000::149, 2620:149:a21:f000::202, 2620:149:a00:f000::160, 2620:149:a0d:f000::135, 2620:149:a0d:f000::139, 2620:149:a0c:f000::5
* IPv4: 17.193.136.202, 17.253.5.158, 17.253.17.202, 17.253.83.135, 17.253.17.209, 17.253.5.135, 17.253.83.149, 17.193.136.201
*   Trying [2620:149:a0c:f000::9]:443...
* Connected to app-site-association.cdn-apple.com (2620:149:a0c:f000::9) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=US; ST=California; O=Apple Inc.; CN=app-site-association.cdn-apple.com
*  start date: Jun 15 23:51:02 2026 GMT
*  expire date: Sep  9 18:50:38 2026 GMT
*  subjectAltName: host "app-site-association.cdn-apple.com" matched cert's "app-site-association.cdn-apple.com"
*  issuer: C=US; O=Apple Inc.; CN=Apple Public Server ECC CA 1 - G1
*  SSL certificate verify ok.
* using HTTP/1.x
> GET /a/v1/auth.fiixstg.com HTTP/1.1
> Host: app-site-association.cdn-apple.com
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 OK
< Server: AppleHttpServer/963281774dffbe1fcdda324ab06683f6ca0dc21c
< Date: Tue, 28 Jul 2026 15:51:49 GMT
< Content-Type: application/json
< Content-Length: 336
< Apple-From: https://auth.fiixstg.com/.well-known/apple-app-site-association
< Apple-Origin-Format: json
< Cache-Control: max-age=3600,public
< Vary: Accept-Encoding
< X-B3-TraceId: 5fa53fe90fafa85d
< Strict-Transport-Security: max-age=31536000
< Age: 0
< Via: https/1.1 usprz4-vp-vst-005.ts.apple.com (acdn/327.16648), https/1.1 usprz4-vp-vfe-004.ts.apple.com (acdn/327.16648), https/1.1 usscz2-edge-lx-006.ts.apple.com (acdn/327.16648), https/1.1 usscz2-edge-bx-037.ts.apple.com (acdn/327.16648)
< X-Cache: hit-stale, miss, miss, miss
< CDNUUID: 07d62070-6cfe-4371-adbb-cb242b3a8fd6-176072202
< Connection: keep-alive
< 
* Connection #0 to host app-site-association.cdn-apple.com left intact
{"applinks":{"apps":[],"details":[{"appID":"DU2N9K888H.com.fiix.enterprise.fiixcmms","paths":["/ios/com.fiix.enterprise.fiixcmms/*"]},{"appID":"2CCMTWT3RW.com.fiix.cmms.mobile.dev","paths":["/ios/com.fiix.cmms.mobile.dev/*"]}]},"webcredentials":{"apps":["DU2N9K888H.com.fiix.enterprise.fiixcmms","2CCMTWT3RW.com.fiix.cmms.mobile.dev"]}}%                    albert@Albert-Black-M3 ~ % curl -v https://app-site-association.cdn-apple.com/a/v1/auth.fiixstg.com   

Albert  WWDR