> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Universal links

> Handle the universal link that brings a user from a VPP operator's app into yours.

A user can start in the VPP operator's app: they grant access to their device or enroll in a program there. A user who selected a managed tariff on your [Programs](/docs/energy-api/reference/connect/vpp/programs.md#managed-tariffs) page arrives the same way, after signing up with the VPP operator. In both cases Flatpeak sends them to your app through the `universal_link_url` set in the Console, with the Connect session ID appended:

```text theme={"system"}
https://app.nova.com/flatpeak?connect_session=cos_6587fa4362341be5b524de3b
```

To try it in test mode, grant the **Antarctic Smart** tariff from the Antarctic Energy customer portal. See [Test VPP programs](/docs/energy-api/guides/platform/test-vpp-programs.md).

## Handling universal links

1. Open your app if it is installed and set up for Universal Links (iOS) or App Links (Android). Otherwise open the link in the browser.
2. Read `connect_session` from the URL.
3. [Retrieve](/docs/energy-api/reference/connect-sessions/retrieve.md) the Connect session and check it is valid and not expired.
4. Check the user is signed in, and ask them to sign in if not.
5. Find the device. If the session has a `device_id`, check that it belongs to the signed-in user and use it; if it has none, or the device is someone else's, ask the user to pick a device. The session carries a `device_id` when the user started from your Programs page and the VPP operator passed the sign-up reference back. Create the device, and its location if needed, when Flatpeak does not have it, then [update the Connect session](/docs/energy-api/reference/connect-sessions/update.md) with `device_id` and `location_id`.
6. [Start the session](/docs/energy-api/reference/connect/tariff/start-session.md) with `flow` `AUTO`.

A universal link is navigation only, so never treat it as proof of authentication. Use HTTPS, and do not store `connect_session`.

## Platform setup

| Platform | Setup |
| :- | :- |
| iOS | Add the Associated Domains capability for the `universal_link_url` domain. Host an `apple-app-site-association` file on it. |
| Android | Add an intent filter for the `universal_link_url` domain. Host an `assetlinks.json` file on it and verify the domain. |

## When the session completes

Your backend receives `connect_session.complete`. Read the consents the user granted on the device: if they consented to telemetry, start sending it, and if they consented to control, start fetching and applying instructions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.