# Set up seamless credential sharing across Android apps and websites

Maximize user convenience by enabling cross-platform seamless credential
sharing across your apps and websites. When multiple websites and Android apps
share an account management backend, this feature allows users to save
credentials once and have them automatically suggested on any linked website or
Android app.

There are two supported methods to set up credential sharing:

- **Play Console** : Recommended for most developers when setting up credential sharing with Android apps. This method lets you configure credential sharing without needing to release a new version of your app. Note that even when using Play Console, you still need to publish a valid `assetlinks.json` file on your website.
- **Digital Asset Links (DALs)**: Suitable for advanced use cases, such as supporting multiple apps or domains with more complex configurations.

> [!IMPORTANT]
> **Key Point:** Regardless of how you set up credential sharing, Password Manager treats credential sharing relationships as transitive. This means if website A shares credentials with website C, and website B also shares credentials with website C, then website A and website B will *automatically* share credentials with each other as well.

### Best practices

For optimal user experience and security, implement seamless credential sharing
across these touchpoints:

- **Sign-in form**: Enable automatic credential filling.
- **Sign-up form**: Securely store new credentials for use across platforms.
- **Password change form**: Synchronize password updates across all platforms.
- **Password reset form**: Allow single password resets to update all platforms.
- **Webview domains** : Extend credential sharing to [webview domains](https://developers.google.com/develop/ui/views/layout/webapps) within your app that handle account management (host sign-in, sign-up, password change, or password reset forms).
- **Android apps**

This approach creates a unified credential management system, enhancing both
user convenience and security.

When designing your account management websites, we suggest you follow these
best practices for account management sites:

- [Design your sign-up form in accordance with best practices](https://web.dev/articles/sign-up-form-best-practices)
- [Design your sign-in form in accordance with best practices](https://web.dev/articles/sign-in-form-best-practices)
- [Add a well-known URL for changing passwords](https://web.dev/articles/change-password-url)

When designing your Android apps, we recommend you [integrate your app with Android Credential Manager](https://developers.google.com/training/sign-in/passkeys).

## Set up credential sharing using Play Console

You can now enable seamless credential sharing directly from [Play
Console](https://play.google.com/console/developers/app/deeplinks) without
publishing a new version of your Android app. This method simplifies the process
by managing your credential sharing configurations through the Play Console
interface.

> [!TIP]
> **Tip:** Play Console generates the required JSON snippet, instructs you where to publish it on your website, and then validates it once it is in place to help prevent configuration errors.

### Prerequisites

Before setting up credential sharing using Play Console, ensure you have:

- The necessary Play Console permissions to access the **Deep links** and **App configuration** sections. If you're not the account owner, ask your Play Console administrator to grant you the appropriate access.
- Ability to publish a `/.well-known/assetlinks.json` file on each respective domain, following the [Digital Asset Links (DALs) syntax](https://developers.google.com/digital-asset-links/v1/statements).

### Enable credential sharing for a new domain

To set up seamless credential sharing in Play Console for a new domain, follow
these steps:

1. Open **Play Console** and go to the [**Deep links**](https://play.google.com/console/developers/app/deeplinks) page (**Grow users \> Deep links**).
2. Under the **App configuration** tab, click **Add domain**.
3. Enter your website's domain.
4. Turn on the **Enable credential sharing** toggle.
5. Copy the generated JSON file and publish it at the specified location (`https://YOUR_DOMAIN/.well-known/assetlinks.json` according to [the protocol](https://github.com/google/digitalassetlinks/blob/master/well-known/details.md#website)), or add the relevant information to the existing assetlinks.json file.
6. Click **Create website association**.

If successful, you'll return to the **Deep links** page.

### Enable credential sharing for an existing domain

To set up seamless credential sharing in Play Console for an existing domain,
follow these steps:

1. Select the **App configuration** tab.
2. In the **Domains** section, under **App configuration** , click **Turn
   on** in the **Credential sharing** column.
3. Copy the generated JSON file and publish it at the specified location (or add the relevant information to the existing `assetlinks.json` file).
4. Click **Turn on credential sharing**.

If successful, you'll return to the **Deep links** page.

## Set up credential sharing using only Digital Asset Links (DALs)

For complex setups involving multiple apps or websites, use Digital Asset Links
(DALs) to configure credential sharing manually.

### Prerequisites

Before setting up seamless credential sharing, ensure you have the following for
each platform:

For each Android app:

- The [Android application ID](https://developers.google.com/build/configure-app-module), as declared in the app's `build.gradle` file.
- The [SHA256 fingerprints](https://developers.google.com/studio/publish/app-signing#sign-apk) of the signing certificate.
- (Recommended) User sign-in implemented [with the Credential Manager API](https://developers.google.com/training/sign-in/passkeys).

For each website:

- Ability to publish a `/.well-known/assetlinks.json` file on each respective domain, following the [Digital Asset Links (DALs) syntax](https://developers.google.com/digital-asset-links/v1/statements).
- All account management domains (sign-in, sign-up, password change, or password reset forms) must be accessible over HTTPS.

> [!NOTE]
> **Note:** While Chrome automatically shares saved credentials between [same-site](https://web.dev/articles/same-site-same-origin) websites (for example, `www.example.com` and `m.example.com`), sharing between websites and Android apps (including App WebViews) behaves differently. For app integration, you must configure Digital Asset Links (DALs) by placing a valid `assetlinks.json` file at `/.well-known/assetlinks.json` on every subdomain your app interacts with to enable credential sharing.

### Enable seamless credential sharing across Android apps and websites

To configure seamless credential sharing across apps and websites, you create
and publish [Digital Asset Links statement lists](https://developers.google.com/digital-asset-links/v1/create-statement#website_statement_file) that declare which
entities (websites or Android apps) are allowed to share credentials.

> [!IMPORTANT]
> **Important:** Password Manager treats credential sharing relationships as transitive.

To declare a credential sharing relationship:

1. Create an `assetlinks.json` file with statements linking to the website and
   to the Android app, following the [DALs statement list syntax](https://developers.google.com/digital-asset-links/v1/statements):

       [
         {
           "relation":[
             "delegate_permission/common.get_login_creds"
           ],
           "target":{
             "namespace":"web",
             "site":URL
           }
         },
         {
           "relation":[
             "delegate_permission/common.get_login_creds"
           ],
           "target":{
             "namespace":"android_app",
             "package_name":"APP_ID",
             "sha256_cert_fingerprints":[
               "SHA_HEX_VALUE"
             ]
           }
         }
       ]

   Where `URL` is your site's URL,
   `APP_ID` is your [Android application ID](https://developers.google.com/build/configure-app-module),
   and `SHA_HEX_VALUE` is the SHA256 fingerprint of
   your Android app [signing certificate](https://developers.google.com/studio/publish/app-signing#sign-apk).

   The `relation` field describes the relationship being declared. To declare
   that apps and sites share sign-in credentials, specify the relationships as
   `delegate_permission/common.get_login_creds`. Learn more about
   [Relation Strings in DALs](https://developers.google.com/digital-asset-links/v1/relation-strings).

   The `target` field is an object that specifies the asset the declaration
   applies to.

   The following fields identify a website:

   |---|---|
   | `namespace` | `web` |
   | `site` | The website's URL, in the format `https://domain[:optional_port`\]; for example, https://www.example.com. The `domain` must be fully-qualified, and `optional_port` must be omitted when using port 443 for HTTPS. A `site` target can only be a root domain: you cannot limit an app association to a specific subdirectory. Don't include a path in the URL, such as a trailing slash. Subdomains are not considered to match: that is, if you specify the `domain` as www.example.com, the domain www.counter.example.com is not associated with your app. |

   The following fields identify an Android app:

   |---|---|
   | namespace | android_app |
   | package_name | The package name declared in the app's manifest. For example, com.example.android |
   | sha256_cert_fingerprints | The SHA256 fingerprints of your app's [signing certificate](https://developers.google.com/studio/publish/app-signing#sign-apk). |

   > [!IMPORTANT]
   > **Important:** When establishing seamless credential sharing between a website and an Android app, we include a self-referential statement in the website's `assetlinks.json` file. This is necessary because the Android app manifest references this file during subsequent configuration steps to enable password sharing.

2. Host the Digital Asset Links JSON file at the following location on the
   sign-in domains:
   `https://DOMAIN[:OPTIONAL_PORT]/.well-known/assetlinks.json`
   , where `DOMAIN` is fully-qualified, and
   `OPTIONAL_PORT` must be omitted when using port 443 for
   HTTPS.

   > [!NOTE]
   > **Note:** The Digital Asset Links JSON file must be served as `Content-Type: application/json` in the HTTP headers, and it cannot be a redirect (see, [Creating a Statement List](https://developers.google.com/digital-asset-links/v1/create-statement#website_statement_file)).

3. Declare the association in the Android app by embedding a statement in your
   Android app's `res/values/strings.xml` file that links to the statement list you
   created in Step 1. Add an object that specifies the `assetlinks.json` files to
   load. For example:

         <string name="asset_statements" translatable="false">
       [{
         \"include\": \"https://DOMAIN[:OPTIONAL_PORT]/.well-known/assetlinks.json\"
       }]
       </string>

   Replace `DOMAIN` and
   `OPTIONAL_PORT` (must be omitted when using port
   443 for HTTPS)---for example `https://www.example.com`. Escape any apostrophes
   and quotation marks you use in the string.

   You can also add a JSON snippet in your `strings.xml` file as shown in
   [the DALs documentation](https://developers.google.com/digital-asset-links/v1/create-statement#android_app_statement_file), but using the `include` statement lets you
   change statements *without publishing a new version of your app*.
4. Reference the statement in the manifest by adding the following line to your
   app's `AndroidManifest.xml` file under `<application>`:

       <meta-data android:name="asset_statements" android:resource="@string/asset_statements"/>

5. Publish the new version of your Android app to the Google Play Developer
   Console

   > [!IMPORTANT]
   > **Important:** Seamless credential sharing will take effect only after you publish a new version of your Android app that includes a reference to the `assetlinks.json` file hosted on your website.

After following these steps, you have successfully set up seamless credential
sharing between your website and your Android app.

Note that this is not the only valid way to set up DALs for credential sharing,
but this approach simplifies the future process of adding new entities to your
seamless credential sharing network, promotes code reusability, and reduces
the potential for errors during updates.