Stay organized with collections
Save and categorize content based on your preferences.
To prevent unauthorized parties from using your API key to create Dynamic Links that
redirect from your domain to sites you don't own, you should specify the URLs
your Dynamic Links can redirect to.
To specify the allowed URLs, click
more_vert> Allowlist URL pattern
from the Dynamic Links page of the Firebase console, and then specify up to
10 regular expressions using
RE2 syntax. Only URLs
that match one of these regular expressions can be successfully used as a deep
link (link) or fallback link (afl, ifl, ipfl, ofl) for a Dynamic Links. If
you specify URL patterns, any URL that doesn't match one of the patterns will
cause your Dynamic Links to return HTTP error 400.
You should make your URL patterns as restrictive as possible. For example:
Too permissive
Better
^https://.*.com/.*$
Can redirect to any page on any site ending with .com.
^https://mybrand\.com/.*$
Can redirect only to pages at mybrand.com.
^https://play.google.com/.*$
Can redirect to any app's Google Play Store page.
^https://play\.google\.com/.*id=myapp\.com$
Can redirect only to Google Play Store pages for the app with the
package name myapp.com.
^https://itunes.apple.com/.*$
Can redirect to any page on itunes.apple.com.
^https://itunes\.apple\.com/.*id123$
Can redirect only to the App Store page for the app with the ID
id123.
You can make sure a deep link and fallback links for a Dynamic Links match one of
your URL patterns by viewing the debug page for Dynamic Links and verifying there are
no warnings:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[],[],null,["\u003cbr /\u003e\n\n| **Note:** Firebase Dynamic Links is *deprecated* and should not be used in new projects. The service will be shutting down soon. Follow the [migration guide](/support/dynamic-links-faq#how_should_i_migrate_from_the_service) and see the [Dynamic Links Deprecation FAQ](/support/dynamic-links-faq) for more information.\n\nTo prevent unauthorized parties from using your API key to create Dynamic Links that\nredirect from your domain to sites you don't own, you should specify the URLs\nyour Dynamic Links can redirect to.\n\nTo specify the allowed URLs, click\nmore_vert **\\\u003e Allowlist URL pattern**\nfrom the Dynamic Links page of the Firebase console, and then specify up to\n10 regular expressions using\n[RE2 syntax](https://github.com/google/re2/wiki/Syntax). Only URLs\nthat match one of these regular expressions can be successfully used as a deep\nlink (`link`) or fallback link (`afl`, `ifl`, `ipfl`, `ofl`) for a Dynamic Links. If\nyou specify URL patterns, any URL that doesn't match one of the patterns will\ncause your Dynamic Links to return HTTP error 400.\n\nYou should make your URL patterns as restrictive as possible. For example:\n\n| Too permissive | Better |\n|----------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|\n| `^https://.*.com/.*$` Can redirect to any page on any site ending with `.com`. | `^https://mybrand\\.com/.*$` Can redirect only to pages at `mybrand.com`. |\n| `^https://play.google.com/.*$` Can redirect to any app's Google Play Store page. | `^https://play\\.google\\.com/.*id=myapp\\.com$` Can redirect only to Google Play Store pages for the app with the package name `myapp.com`. |\n| `^https://itunes.apple.com/.*$` Can redirect to any page on `itunes.apple.com`. | `^https://itunes\\.apple\\.com/.*id123$` Can redirect only to the App Store page for the app with the ID `id123`. |\n\nYou can make sure a deep link and fallback links for a Dynamic Links match one of\nyour URL patterns by viewing the debug page for Dynamic Links and verifying there are\nno warnings: \n\n```\nhttps://example.page.link/WXYZ?d=1\n```"]]
