Changelog
What shipped, and when.
Every entry describes something a customer could notice. Fixes are listed alongside features, because a changelog that only mentions good news is an advertisement.
Cordova on Android: links and install referrers now reach the SDK
Android on Cordova could not receive a link or return an install referrer. Both are fixed in SDK 0.2.3, the documentation now covers Android, and the live view says why an install was not attributed instead of guessing.
- SDK 0.2.3 reads links from ionic-plugin-deeplinks and install referrers from cordova-plugin-installreferrer. Before this, neither reached the SDK on a Cordova app: the one delivery plugin we recognised was a package last released in 2016, and the install-referrer lookup expected a shape no published Cordova plugin provides. An Android App Link opened the app and nothing arrived in JavaScript.
- The Cordova documentation now covers Android. It described the delivery problem correctly and then solved only iOS, so an Android integration had no instructions at all — and /docs/android gave a Capacitor install command to everybody, including Cordova projects. Both pages now name the plugin and the command for each framework separately.
- The live view says why an install was not attributed. It used to say that no click from the device had reached us, which it could not know and which was sometimes false — the reason the matcher gave was never recorded. Each of the four reasons now has its own explanation, and where a Play Install Referrer is expected the view says whether one arrived.
- Android attribution is described accurately: exact when the install referrer arrives, which requires an install-referrer plugin in your app. It previously read as exact without qualification.
Links, the redirect service, the SDK and attribution
The half of the product that was missing: making links, serving them, and telling you where an install came from.
- Create links, give them a destination and a required web fallback, and they resolve at your app’s own link host. Archiving and expiry are handled, and an archived link lands on the fallback rather than an error.
- We now serve the apple-app-site-association file Apple fetches, built from the bundle identifier and Team ID you entered. There is a page that tells you whether Apple has actually collected it, because Apple caches it for up to 24 hours and a correct setup looks broken until it does.
- The @quberoute/sdk package: Capacitor first, and the same package on Cordova, React Native and the web. The whole integration is five lines. It reads no advertising identifier, cannot block your app starting, and cannot crash it if we are unreachable. The only permission it can cause to be requested is the clipboard, and only for apps that switched clipboard matching on.
- Deferred deep linking — the right screen after an install, not only when the app is already there. Exact when the link survives the install; a measured guess when it does not.
- Published match rates, including the bad case. Fallback matching is measured against a simulated population and both the match rate and the false positive rate are published on the documentation page, including the worst case. The fallback is off until you switch it on.
- Clipboard matching, off by default, as an exact alternative to guessing — at the cost of a visible paste banner on iOS. What your users see is described in Apple’s own words on the documentation page.
- An attribution report per app: clicks, installs, events, a breakdown by link, and the confidence distribution behind every attributed install.
- Publishable API keys, for the key that ships inside your app binary. A publishable key can identify an install and nothing else — it cannot create, edit or delete anything, which a secret key in a shipped binary could.
- A QR code for every link, generated from the link itself so it cannot point anywhere else, and a CSV export of the link list.
Fixes to app creation and sign-out
Two faults that a person using the product would have hit within their first five minutes, and the tests that will stop the next one.
- Creating an app no longer fails on the page it takes you to afterwards. The app was always created correctly; the page that displayed it crashed.
- Signing out from the “confirm your email address” page works. It previously led to a page that did not exist.
- The invitation page now offers a sign-out button where it tells you to sign in as somebody else, instead of only saying so.
- Added browser-level tests that load every page in a real browser and fail on any error. All three of the faults found so far were invisible to the previous tests.
Accounts, apps, iOS configuration and API keys
The first release you can actually sign up for and use.
- Create an account, confirm your email address, and sign in. Optional two-factor authentication using any authenticator app, with ten single-use backup codes.
- Organisations with owner, admin and member roles. Invite people by email; an organisation can never be left without an owner.
- Add apps. Each one is allocated a permanent five-character link host that is never reused.
- iOS configuration: bundle identifier, Apple Team ID, URI scheme and App Store details, each validated with a message that says what to fix.
- Live and test environments, switchable from every page, with an unmissable banner while you are in test.
- API keys, scoped to one app and one environment, shown once, rotatable and revocable. Revocation takes effect on the very next request.
- Password reset, email address changes, and a warning to the address owner when somebody tries to sign up with an address that already has an account.
Foundations
The database, the schema and the rules everything else is built on. Nothing customer-facing.
- Database in London, with UK data residency as a constraint on every future choice rather than a setting.
- Every link is required to have a web fallback address before it can be saved, so an expired or archived link can never resolve to an error page.
- Subdomain keys are generated from a vowel-free alphabet, so a key can never spell a word, and are never recycled.
- Nothing customer-facing is ever hard-deleted; the database itself refuses it.
What the product does, and the limits of what it does, are in the documentation.