[{"data":1,"prerenderedAt":2398},["ShallowReactive",2],{"/blog/programmableweb-shut-down-api-directories-2026/":3,"/blog/programmableweb-shut-down-api-directories-2026/-related":732,"/blog/programmableweb-shut-down-api-directories-2026/-resources":2380},{"id":4,"title":5,"author":6,"body":10,"category":669,"createdAt":670,"description":671,"disclosure":672,"extension":673,"faq":674,"howTo":672,"location":687,"meta":688,"navigation":694,"ogImage":672,"path":695,"primaryKeyword":696,"readingTime":697,"related":698,"seo":702,"sources":703,"stem":722,"tags":723,"takeaways":724,"updatedAt":670,"url":730,"__hash__":731},"blog/blog/programmableweb-shut-down-api-directories-2026.md","ProgrammableWeb Shut Down: Where to Find and Vet APIs in 2026",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":651},"minimark",[13,21,24,30,35,46,51,54,120,123,127,318,321,337,341,374,378,381,443,447,485,502,506,509,559,562,566,575,579,585,588,613,617,620,628],[14,15,16,20],"p",{},[17,18,19],"strong",{},"ProgrammableWeb, the site many developers used to find APIs, shut down on October 31, 2022, and nothing took its place one for one."," In 2026, you find APIs through a mix of the Postman API Network, RapidAPI Hub, the APIs.guru OpenAPI directory, the public-apis list on GitHub, APIs.io and the APILayer marketplace. None of them vets an API for you. That step is yours, and the checklist below shows how an app studio does it.",[14,22,23],{},"This page replaces the old ProgrammableWeb links that still sit in many articles. Dates come from ProgrammableWeb's own shutdown notice. Directory URLs, counts and GitHub stars were checked on October 17, 2026.",[14,25,26,29],{},[17,27,28],{},"Disclosure:"," App369 builds Flutter and Firebase apps and integrates third-party APIs for clients. We have no commercial relationship with any directory listed here, and none paid to be on this page.",[31,32,34],"h2",{"id":33},"what-happened-to-programmableweb","What happened to ProgrammableWeb",[14,36,37,38,45],{},"ProgrammableWeb announced on October 10, 2022 that, after 17 years, it would shut down operations on October 31. It first launched in 2005 and was later acquired by MuleSoft. Its API directory had grown to over 24,000 entries, and its API University series had over 800 articles. In the notice, the staff wrote that the MuleSoft blog and resource center \"will continue to host the most popular and valuable content that was produced by ProgrammableWeb.\" The notice is archived at the ",[39,40,44],"a",{"href":41,"rel":42},"http://web.archive.org/web/20221010220313/https://www.programmableweb.com/news/programmableweb-being-retired/brief/2022/10/10",[43],"nofollow","Wayback Machine",".",[47,48,50],"h3",{"id":49},"what-the-old-addresses-do-today","What the old addresses do today",[14,52,53],{},"We checked these on October 17, 2026.",[55,56,57,70],"table",{},[58,59,60],"thead",{},[61,62,63,67],"tr",{},[64,65,66],"th",{},"Old address",[64,68,69],{},"What it does now",[71,72,73,82,95,102,112],"tbody",{},[61,74,75,79],{},[76,77,78],"td",{},"The main site (www, over HTTPS)",[76,80,81],{},"Fails the TLS handshake (we saw \"tlsv1 alert internal error\" in curl). Treat it as dead.",[61,83,84,92],{},[76,85,86,87,91],{},"The old API directory page (",[88,89,90],"code",{},"/apis/directory",", over HTTP)",[76,93,94],{},"Returns 404.",[61,96,97,100],{},[76,98,99],{},"The old blog subdomain (over HTTP)",[76,101,94],{},[61,103,104,109],{},[76,105,106],{},[88,107,108],{},"mulesoft.com/programmableweb",[76,110,111],{},"Redirects to the MuleSoft blog home page, not to the old articles.",[61,113,114,117],{},[76,115,116],{},"Wayback Machine copies",[76,118,119],{},"Work. The last 200-status homepage snapshot we found is from January 30, 2023.",[14,121,122],{},"If you edit an article that links to ProgrammableWeb, swap the link for this page, or for a Wayback copy if you are citing a specific old article.",[31,124,126],{"id":125},"programmableweb-api-directory-the-closest-alternatives-in-2026","ProgrammableWeb API directory: the closest alternatives in 2026",[55,128,129,145],{},[58,130,131],{},[61,132,133,136,139,142],{},[64,134,135],{},"Directory",[64,137,138],{},"What it is",[64,140,141],{},"Best for",[64,143,144],{},"Source",[71,146,147,167,193,218,238,258,278,298],{},[61,148,149,154,157,160],{},[76,150,151],{},[17,152,153],{},"Postman API Network",[76,155,156],{},"Public APIs and collections published by companies and people on Postman",[76,158,159],{},"Finding an API you can try right away in a request collection",[76,161,162],{},[39,163,166],{"href":164,"rel":165},"https://www.postman.com/explore",[43],"postman.com/explore",[61,168,169,174,177,180],{},[76,170,171],{},[17,172,173],{},"RapidAPI Hub",[76,175,176],{},"An API marketplace. Nokia announced on November 13, 2024 that it had acquired Rapid's technology assets, including the API hub, and its R&D unit.",[76,178,179],{},"Browsing many paid and free APIs in one place",[76,181,182,187,188],{},[39,183,186],{"href":184,"rel":185},"https://rapidapi.com/hub",[43],"rapidapi.com/hub",", ",[39,189,192],{"href":190,"rel":191},"https://www.nokia.com/newsroom/nokia-acquires-rapid-technology-and-rd-unit-to-strengthen-development-of-network-api-solutions-and-ecosystem/",[43],"Nokia",[61,194,195,200,203,206],{},[76,196,197],{},[17,198,199],{},"APIs.guru OpenAPI directory",[76,201,202],{},"An open directory of OpenAPI specs, also on GitHub as APIs-guru/openapi-directory. On October 17, 2026: 2,529 APIs, 3,992 specs, 677 providers.",[76,204,205],{},"Getting a machine-readable spec to generate clients and tests",[76,207,208,187,213],{},[39,209,212],{"href":210,"rel":211},"https://apis.guru/",[43],"apis.guru",[39,214,217],{"href":215,"rel":216},"https://api.apis.guru/v2/metrics.json",[43],"metrics",[61,219,220,225,228,231],{},[76,221,222],{},[17,223,224],{},"public-apis on GitHub",[76,226,227],{},"A community list of free APIs. About 489,000 GitHub stars, MIT license, last pushed October 15, 2026.",[76,229,230],{},"Quick ideas and prototypes",[76,232,233],{},[39,234,237],{"href":235,"rel":236},"https://github.com/public-apis/public-apis",[43],"GitHub",[61,239,240,245,248,251],{},[76,241,242],{},[17,243,244],{},"APIs.io",[76,246,247],{},"A search engine for APIs, with listings that draw on APIs.json and OpenAPI files",[76,249,250],{},"Searching for APIs by what you want to do",[76,252,253],{},[39,254,257],{"href":255,"rel":256},"https://apis.io/",[43],"apis.io",[61,259,260,265,268,271],{},[76,261,262],{},[17,263,264],{},"APILayer marketplace",[76,266,267],{},"A marketplace of APIs. any-api.com now redirects to it.",[76,269,270],{},"Ready-made utility APIs (data, conversion, lookup)",[76,272,273],{},[39,274,277],{"href":275,"rel":276},"https://marketplace.apilayer.com/",[43],"marketplace.apilayer.com",[61,279,280,285,288,291],{},[76,281,282],{},[17,283,284],{},"Free Public APIs",[76,286,287],{},"A directory of free APIs. Two similar sites also exist: publicapis.dev (titled \"1400+ Public APIs\") and apilist.fun.",[76,289,290],{},"Free APIs for demos",[76,292,293],{},[39,294,297],{"href":295,"rel":296},"https://www.freepublicapis.com/",[43],"freepublicapis.com",[61,299,300,305,308,311],{},[76,301,302],{},[17,303,304],{},"MuleSoft Anypoint Exchange",[76,306,307],{},"MuleSoft's catalog of APIs and assets, mostly shared by teams that use MuleSoft",[76,309,310],{},"Teams that already use MuleSoft",[76,312,313],{},[39,314,317],{"href":315,"rel":316},"https://anypoint.mulesoft.com/exchange/",[43],"anypoint.mulesoft.com/exchange",[14,319,320],{},"Notes on the table:",[322,323,324,328,331,334],"ul",{},[325,326,327],"li",{},"All of these returned a normal page on October 17, 2026. That is not a quality rating.",[325,329,330],{},"The public-apis list used to have a companion JSON endpoint, api.publicapis.org. It no longer responds, so do not build on it.",[325,332,333],{},"Prices and listing fees are left out because they change often. Check each site before you list an API or rely on a paid plan.",[325,335,336],{},"A directory entry can be out of date. Always confirm details on the provider's own site.",[47,338,340],{"id":339},"which-one-to-start-with","Which one to start with",[342,343,344,350,356,362,368],"ol",{},[325,345,346,349],{},[17,347,348],{},"You need a spec to generate code or tests."," Start with APIs.guru, then look at the provider's own docs.",[325,351,352,355],{},[17,353,354],{},"You want to try calls in minutes."," Start with the Postman API Network.",[325,357,358,361],{},[17,359,360],{},"You want one place to compare paid APIs."," Look at RapidAPI Hub or the APILayer marketplace, and read the terms.",[325,363,364,367],{},[17,365,366],{},"You want free APIs for a prototype."," Start with the public-apis list. Do not ship a product on a free hobby API without a plan B.",[325,369,370,373],{},[17,371,372],{},"You want to find APIs by topic."," Try APIs.io, but expect gaps.",[31,375,377],{"id":376},"how-to-vet-an-api-before-you-build-an-app-on-it","How to vet an API before you build an app on it",[14,379,380],{},"A directory listing says an API exists. It does not say the API will still be there next year. Run this checklist before you commit, and write down the answers.",[342,382,383,389,395,401,407,413,419,425,431,437],{},[325,384,385,388],{},[17,386,387],{},"Docs and spec."," Are there current docs, working examples and an OpenAPI spec? An API with no spec is harder to test and to replace. Check the date of the last docs update.",[325,390,391,394],{},[17,392,393],{},"Authentication."," Does it use OAuth 2.0 or API keys? Can you rotate keys without downtime? Can you scope keys to the least access needed?",[325,396,397,400],{},[17,398,399],{},"Rate limits."," What are the limits per second, minute and month? What happens when you exceed them: an error, a throttle or a surprise bill? Multiply the limit by your expected users, not by your test traffic.",[325,402,403,406],{},[17,404,405],{},"Pricing tiers."," What does the free tier include? What does your expected volume cost? Look for per-call fees, overage rates and minimum commitments.",[325,408,409,412],{},[17,410,411],{},"Uptime and support."," Is there a public status page, an incident history and an SLA? A free API usually has no SLA. A paid one should state it in writing.",[325,414,415,418],{},[17,416,417],{},"Versioning and deprecation."," Is the version in the URL? How much notice does the provider give before it removes a version? A provider with no written policy is a risk.",[325,420,421,424],{},[17,422,423],{},"Terms of use."," Can you use the data commercially? Can you cache or store it, and for how long? Can you show it in a mobile app? Does the license restrict competing products?",[325,426,427,430],{},[17,428,429],{},"Data and privacy."," What user data do you send? Where is it processed and stored? Does the provider act as your processor under a data processing agreement? If you handle health, payment or children's data, check this first.",[325,432,433,436],{},[17,434,435],{},"Who owns it."," Which company runs it, and was it acquired or renamed recently? Ownership changes are a common cause of changed terms and shutdowns. RapidAPI Hub is an example: Nokia announced the acquisition of Rapid's technology in 2024.",[325,438,439,442],{},[17,440,441],{},"A shutdown plan."," If this API disappears in 90 days, what do you do? Name a second provider, or decide you can live without the feature.",[47,444,446],{"id":445},"build-so-you-can-swap-a-provider","Build so you can swap a provider",[322,448,449,455,461,467,473,479],{},[325,450,451,454],{},[17,452,453],{},"Route calls through your backend."," Do not call a third-party API straight from the mobile client. Your backend can change providers, add caching, and enforce limits. A change in the backend does not need an app store review. A change inside the app binary does.",[325,456,457,460],{},[17,458,459],{},"Never ship secret keys in the app."," Anything inside an app binary can be extracted. Keep secrets on the server, in a secrets manager, and give the app only short-lived tokens issued by your own backend.",[325,462,463,466],{},[17,464,465],{},"Wrap each provider behind your own interface."," Your app code asks for \"send email\" or \"get exchange rate\". Only one module knows which vendor does it.",[325,468,469,472],{},[17,470,471],{},"Store the raw responses you need."," If the terms allow it, keep a copy of the data your product depends on, so a shutdown does not erase your history.",[325,474,475,478],{},[17,476,477],{},"Monitor the dependency."," Alert on errors and slow responses from each external API, so you see a problem before your users do.",[325,480,481,484],{},[17,482,483],{},"Test the failure path."," Turn the API off in a test and check that the app shows a clear message instead of a blank screen.",[14,486,487,488,492,493,497,498,45],{},"For key handling in the newer MCP and AI tool world, see our guide to ",[39,489,491],{"href":490},"/blog/mcp-server-authentication-api-keys-vs-oauth-2026/","API keys vs OAuth for MCP servers",". For a similar story about a dependency that closed, see ",[39,494,496],{"href":495},"/blog/parse-kinvey-backend-as-a-service-alternatives-2026/","Parse and Kinvey alternatives"," and the ",[39,499,501],{"href":500},"/blog/firebase-dynamic-links-shutdown-deep-linking-2026/","Firebase Dynamic Links shutdown",[31,503,505],{"id":504},"api-documentation-what-good-docs-contain","API documentation: what good docs contain",[14,507,508],{},"ProgrammableWeb ran many pieces on documentation, and editors still link to them. The short version, from the side of the team that has to build on the API:",[322,510,511,517,523,529,535,541,547,553],{},[325,512,513,516],{},[17,514,515],{},"A quickstart that works."," One page that gets a first successful call running in a few minutes, with copy-paste code.",[325,518,519,522],{},[17,520,521],{},"Authentication, explained once and clearly."," How to get a key or token, how to rotate it, and what each scope allows.",[325,524,525,528],{},[17,526,527],{},"Every endpoint with a real request and response."," Not only field lists. Show a full example body for both.",[325,530,531,534],{},[17,532,533],{},"Error codes and what to do about them."," Which errors are safe to retry, and which mean the request is wrong.",[325,536,537,540],{},[17,538,539],{},"Rate limits and pricing in the docs."," The numbers, not \"fair use\".",[325,542,543,546],{},[17,544,545],{},"A changelog and a versioning policy."," Dated entries, and how much notice you get before a breaking change.",[325,548,549,552],{},[17,550,551],{},"An OpenAPI spec you can download."," It lets teams generate clients, mocks and tests instead of copying by hand.",[325,554,555,558],{},[17,556,557],{},"A sandbox or test mode."," So integrators can test without touching real data or money.",[14,560,561],{},"If an API you are vetting misses three or more of these, budget extra time for the integration.",[31,563,565],{"id":564},"api-first-development-in-one-paragraph","API-first development in one paragraph",[14,567,568,569,574],{},"API-first means you design and agree the API contract before anyone builds a client or a server. In practice, the team writes an ",[39,570,573],{"href":571,"rel":572},"https://www.openapis.org/",[43],"OpenAPI"," description first, reviews it with the people who will call it, and then generates mock servers, tests and client SDKs from it. Mobile and web teams can start against the mock while the backend is built. The specs in the APIs.guru directory are examples of this kind of machine-readable contract. For an app, it means fewer surprises late in the project, because the shape of every request is settled up front.",[31,576,578],{"id":577},"where-programmablewebs-articles-and-api-guides-went","Where ProgrammableWeb's articles and API guides went",[14,580,581,582,584],{},"The shutdown notice says the MuleSoft blog and resource center would keep the most popular content. In our check, the old ",[88,583,108],{}," address redirects to the MuleSoft blog home, so there is no one-to-one map from the old articles to new addresses. We did not find an official archive of the full 24,000-entry directory.",[14,586,587],{},"Your options for a specific old page:",[322,589,590,596,602],{},[325,591,592,595],{},[17,593,594],{},"Search the MuleSoft blog"," for the article title.",[325,597,598,601],{},[17,599,600],{},"Use the Wayback Machine."," Paste the old address into it. Link to the archived copy, not to the dead site.",[325,603,604,607,608,612],{},[17,605,606],{},"For API design practice,"," go to the ",[39,609,611],{"href":571,"rel":610},[43],"OpenAPI Initiative",", which maintains the OpenAPI Specification.",[31,614,616],{"id":615},"need-a-hand","Need a hand?",[14,618,619],{},"App369 is Simon Dziak's studio. He builds and runs Workspace369, a production Flutter and Firebase SaaS.",[14,621,622,623,627],{},"If you are connecting an app to a third-party API, such as Stripe, a CRM or a data provider, the closest fixed-price offer is ",[39,624,626],{"href":625},"/fixed-price/api-integration/","API Integration",", $1,200 fixed price, 5 business days after API docs and test credentials for both systems arrive.",[322,629,630,638],{},[325,631,632,633,637],{},"An integration that broke after a provider changed or shut down: the ",[39,634,636],{"href":635},"/fixed-price/flutter-firebase-bug-fix/","App Fix Ticket"," diagnoses one issue for $450 and fixes it for $1,200, both fixed price.",[325,639,640,641,645,646,650],{},"Need a new web app that depends on several APIs: the ",[39,642,644],{"href":643},"/fixed-price/web-app-mvp/","Web App MVP Sprint"," starts with a $450 scoping step and the build starts from $6,000. It is for web apps, not native mobile apps, so if you need a mobile app, ",[39,647,649],{"href":648},"/contact/","get in touch"," first.",{"title":652,"searchDepth":653,"depth":653,"links":654},"",2,[655,659,662,665,666,667,668],{"id":33,"depth":653,"text":34,"children":656},[657],{"id":49,"depth":658,"text":50},3,{"id":125,"depth":653,"text":126,"children":660},[661],{"id":339,"depth":658,"text":340},{"id":376,"depth":653,"text":377,"children":663},[664],{"id":445,"depth":658,"text":446},{"id":504,"depth":653,"text":505},{"id":564,"depth":653,"text":565},{"id":577,"depth":653,"text":578},{"id":615,"depth":653,"text":616},"AI & Technology","2026-10-17T12:00:00.000Z","ProgrammableWeb shut down on Oct 31, 2022. Where to find APIs in 2026 (Postman, RapidAPI, APIs.guru, public-apis), plus a checklist to vet an API.",null,"md",[675,678,681,684],{"question":676,"answer":677},"Is ProgrammableWeb still online?","No. ProgrammableWeb said on October 10, 2022 that it would shut down operations on October 31 after 17 years. When we tested with curl on October 17, 2026, its main site failed the HTTPS handshake, and its old API directory and blog addresses returned 404. The Wayback Machine keeps copies of the old pages.",{"question":679,"answer":680},"What replaced the ProgrammableWeb API directory?","Nothing replaced it one for one. The main alternatives in 2026 are the Postman API Network, RapidAPI Hub, the APIs.guru OpenAPI directory, the public-apis list on GitHub, APIs.io and the APILayer marketplace. They differ in what they list and why, so use more than one and always check the provider's own docs.",{"question":682,"answer":683},"Where did the ProgrammableWeb articles go?","ProgrammableWeb said the MuleSoft blog and resource center would host its most popular content. Some pieces may live there, but the old addresses do not map to it: mulesoft.com/programmableweb redirects to the MuleSoft blog home page. For the rest, search the Wayback Machine for the original address.",{"question":685,"answer":686},"How do I check that an API is safe to build my app on?","Read its docs, auth model, rate limits, pricing tiers, status page, versioning and deprecation policy and terms of use before writing code. Then build a small spike against it, and route the calls through your own backend so you can change provider later.","Boynton Beach, FL",{"readingTimeStats":689},{"text":690,"minutes":691,"time":692,"words":693},"9 min read",8.83,529800,1766,true,"/blog/programmableweb-shut-down-api-directories-2026","programmableweb alternative","10 min",[699,700,701],"mcp-server-authentication-api-keys-vs-oauth-2026","parse-kinvey-backend-as-a-service-alternatives-2026","firebase-dynamic-links-shutdown-deep-linking-2026",{"title":5,"description":671},[704,706,708,709,711,712,714,716,718,719,720,721],{"title":705,"url":41},"ProgrammableWeb Staff, \"ProgrammableWeb is Being Retired\" (October 10, 2022), Wayback Machine copy",{"title":707,"url":164},"Postman API Network (explore)",{"title":173,"url":184},{"title":710,"url":190},"Nokia, \"Nokia acquires Rapid technology and R&D unit\" (November 13, 2024)",{"title":199,"url":210},{"title":713,"url":215},"APIs.guru live metrics (checked October 17, 2026)",{"title":715,"url":235},"public-apis/public-apis on GitHub (MIT license)",{"title":717,"url":255},"APIs.io, API search engine",{"title":264,"url":275},{"title":284,"url":295},{"title":304,"url":315},{"title":611,"url":571},"blog/programmableweb-shut-down-api-directories-2026","programmableweb alternative, programmableweb shut down, api directory, api marketplace, find public apis, how to evaluate an api, vet third-party api, openapi directory, api integration for mobile apps, rapidapi alternative, api documentation best practices, api-first development",[725,726,727,728,729],"ProgrammableWeb shut down on October 31, 2022, after 17 years. Its directory had grown to over 24,000 API entries. When we tested on October 17, 2026, its main site failed the HTTPS handshake and its old directory and blog addresses returned 404.","There is no single replacement. Use Postman API Network, RapidAPI Hub, APIs.guru, the public-apis list on GitHub, APIs.io or the APILayer marketplace, depending on what you need.","APIs.guru is the most transparent: on October 17, 2026 its public metrics listed 2,529 APIs, 3,992 specs and 677 providers.","A directory listing is not a vetting. Before you build on an API, check its docs and OpenAPI spec, auth, rate limits, pricing, uptime record, deprecation policy and terms of use.","Call third-party APIs from your own backend, not straight from the mobile app, and never put secret keys in the app. That lets you swap a provider without an app store release.","https://app369.com/blog/programmableweb-shut-down-api-directories-2026/","m8xl9Cl0SDN8lzboppK-eF8omvtkby9f0_ZoNoTWca4",[733,1098,1598],{"id":734,"title":735,"author":736,"body":738,"category":669,"createdAt":1083,"description":1084,"disclosure":672,"extension":673,"faq":672,"howTo":672,"location":687,"meta":1085,"navigation":694,"ogImage":672,"path":1091,"primaryKeyword":672,"readingTime":1092,"related":672,"seo":1093,"sources":672,"stem":1094,"tags":1095,"takeaways":672,"updatedAt":1083,"url":1096,"__hash__":1097},"blog/blog/mcp-server-authentication-api-keys-vs-oauth-2026.md","MCP Server Authentication for SaaS: API Keys vs OAuth (2026)",{"name":7,"social":737},{"twitter":9},{"type":11,"value":739,"toc":1068},[740,746,758,762,770,783,787,790,858,861,865,868,888,891,894,920,924,927,947,962,965,969,972,1016,1020,1026,1030,1034,1037,1041,1044,1048,1054,1058,1061,1065],[14,741,742,745],{},[17,743,744],{},"If your MCP server runs on your own machine, you probably don't need OAuth; if it is a remote server that your customers connect to from Claude or ChatGPT, you almost certainly do."," The choice depends on who connects, where the server runs, and whether the assistant has to act as one specific user. This guide covers what the MCP specification requires, where API keys or personal access tokens are still a sensible choice, and what Claude and ChatGPT say they expect today.",[14,747,748,749,753,754,45],{},"If you want the server built for you, App369 offers a fixed-price ",[39,750,752],{"href":751},"/fixed-price/mcp-server-for-saas/","MCP Connector for your SaaS",". If you are still deciding whether to build one at all, start with ",[39,755,757],{"href":756},"/blog/how-to-add-an-mcp-server-to-your-saas-2026/","how to add an MCP server to your SaaS",[31,759,761],{"id":760},"local-vs-remote-servers","Local vs remote servers",[14,763,764,765,45],{},"MCP defines two standard transports: stdio and Streamable HTTP. With stdio, the client launches your server as a local subprocess. With Streamable HTTP, the server is a web endpoint that clients reach over the network, which is how a SaaS product normally offers one to many customers. Both are described in the ",[39,766,769],{"href":767,"rel":768},"https://modelcontextprotocol.io/specification/2026-07-28/basic/transports",[43],"MCP transports specification",[14,771,772,773,778,779,782],{},"The ",[39,774,777],{"href":775,"rel":776},"https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",[43],"MCP authorization specification"," is explicit about the split. Authorization is optional. HTTP-based servers that support it should follow the spec. Servers on stdio \"SHOULD NOT\" follow it and should instead retrieve credentials from the environment. So a local server that reads ",[88,780,781],{},"MYAPP_API_KEY"," from an environment variable is normal and spec-aligned. A remote server is a different problem, because the person connecting is a customer you can't hand an environment variable to.",[31,784,786],{"id":785},"what-the-spec-requires-for-remote-servers","What the spec requires for remote servers",[14,788,789],{},"The latest published revision at the time of writing is dated 2026-07-28. The authorization section builds on OAuth 2.1, which is still an IETF draft, not a finished standard. In practice, a remote MCP server that wants to be reachable by standard clients does the following:",[322,791,792,802,814,824,836,842,852],{},[325,793,794,797,798,801],{},[17,795,796],{},"Acts as an OAuth resource server."," It accepts bearer tokens in the ",[88,799,800],{},"Authorization"," header on every request, never in the URL query string.",[325,803,804,807,808,813],{},[17,805,806],{},"Publishes protected resource metadata."," The spec says MCP servers MUST implement ",[39,809,812],{"href":810,"rel":811},"https://datatracker.ietf.org/doc/html/rfc9728",[43],"RFC 9728",", and the metadata must name at least one authorization server.",[325,815,816,819,820,823],{},[17,817,818],{},"Answers unauthenticated requests with a 401"," whose ",[88,821,822],{},"WWW-Authenticate"," header points at that metadata. That is how a client discovers where to sign in.",[325,825,826,829,830,835],{},[17,827,828],{},"Has an authorization server with discovery metadata."," It must provide either ",[39,831,834],{"href":832,"rel":833},"https://datatracker.ietf.org/doc/html/rfc8414",[43],"RFC 8414"," metadata or OpenID Connect Discovery. This can be your existing identity provider, or one you host with the server.",[325,837,838,841],{},[17,839,840],{},"Supports a way for the client to get a client ID."," The 2026-07-28 revision says authorization servers and clients SHOULD support Client ID Metadata Documents, MAY support Dynamic Client Registration, and marks Dynamic Client Registration as deprecated and kept for backwards compatibility. The earlier 2025-06-18 revision listed Dynamic Client Registration as a SHOULD. If you support both, you are covered either way.",[325,843,844,847,848,851],{},[17,845,846],{},"Uses PKCE"," on the authorization code flow, and clients send a ",[88,849,850],{},"resource"," parameter (RFC 8707) that names your server.",[325,853,854,857],{},[17,855,856],{},"Validates the token's audience."," The server must only accept tokens issued for it, and must not pass the token it received on to other APIs. If your MCP server calls your REST API, it should use a credential meant for that API.",[14,859,860],{},"That is a lot of moving parts, but most of them are standard features of an identity provider. The part teams underestimate is the first sign-in: the user lands on a consent screen, approves a connection, and your authorization server issues a token tied to that user.",[31,862,864],{"id":863},"when-api-keys-or-personal-access-tokens-are-enough","When API keys or personal access tokens are enough",[14,866,867],{},"OAuth is the right default for a public, multi-customer remote server. But a key or token is a reasonable choice in some situations:",[322,869,870,876,882],{},[325,871,872,875],{},[17,873,874],{},"Local or internal use."," A developer runs your stdio server on their laptop with their own key. This is the case the spec describes for stdio.",[325,877,878,881],{},[17,879,880],{},"A private connector for one team."," An admin connects a custom server for their organization, and everyone shares access to the same data.",[325,883,884,887],{},[17,885,886],{},"A first version."," Your API already issues keys, and you want customers to try the connector before you invest in an OAuth server.",[14,889,890],{},"Claude's connector documentation describes a static credential option too: an organization Owner enters an API key or bearer token once, and Claude sends it as a request header on every call. Anthropic marks this as beta and available only to a limited set of organizations. It also says to treat the key as the organization's credential rather than a person's, because every member's requests carry the same key, and to use OAuth if your tools must act as the individual user.",[14,892,893],{},"The trade-offs are real:",[322,895,896,902,908,914],{},[325,897,898,901],{},[17,899,900],{},"Users have to copy secrets."," Pasting a key into a settings box is friction, and a pasted key can end up in chat logs, screenshots or notes.",[325,903,904,907],{},[17,905,906],{},"Scoping is on you."," An OAuth token carries scopes the user approved. A key is whatever your key system says it is, so a key that can delete data should not be the same one used for reading reports.",[325,909,910,913],{},[17,911,912],{},"Rotation is manual."," OAuth access tokens are short-lived by design, and the spec recommends short-lived access tokens. Keys tend to live for years unless you build expiry.",[325,915,916,919],{},[17,917,918],{},"Per-user identity is weaker."," If one key serves a whole workspace, your audit log can't say which person asked the assistant to do something.",[31,921,923],{"id":922},"what-claude-and-chatgpt-say-they-expect","What Claude and ChatGPT say they expect",[14,925,926],{},"Both vendors publish requirements. Check them again before you build, because they change.",[14,928,929,932,933,938,939,942,943,946],{},[17,930,931],{},"Claude."," The ",[39,934,937],{"href":935,"rel":936},"https://claude.com/docs/connectors/building/authentication",[43],"authentication guide for Claude connectors"," lists OAuth 2.0 with Dynamic Client Registration and OAuth with Client ID Metadata Documents as supported by default, along with no-auth servers and the beta static-credential option above. It requires a 401 with a ",[88,940,941],{},"resource_metadata"," pointer, S256 PKCE, and a fixed callback URL for the hosted apps. It says a machine-to-machine ",[88,944,945],{},"client_credentials"," grant isn't supported, and that Claude gives your discovery and token endpoints 10 seconds to respond.",[14,948,949,952,953,958,959,961],{},[17,950,951],{},"ChatGPT."," OpenAI's ",[39,954,957],{"href":955,"rel":956},"https://developers.openai.com/apps-sdk/build/auth",[43],"Apps SDK authentication documentation"," says servers that need sign-in should implement an OAuth 2.1 flow that follows the MCP authorization spec, with protected resource metadata, PKCE with S256, and the ",[88,960,850],{}," parameter. It names Client ID Metadata Documents as the preferred registration method, with Dynamic Client Registration still supported. It also lets individual tools be declared callable without authentication, and tells servers to verify every token themselves: signature, issuer, audience, expiry and scopes.",[14,963,964],{},"The pattern is the same in both: if a user's own account is involved, plan on OAuth.",[31,966,968],{"id":967},"practices-that-hold-either-way","Practices that hold either way",[14,970,971],{},"Whatever you pick, these apply:",[342,973,974,980,986,992,998,1004,1010],{},[325,975,976,979],{},[17,977,978],{},"One credential per user, never one shared key."," A shared key can't be revoked for one person and hides who did what.",[325,981,982,985],{},[17,983,984],{},"Least-privilege scopes."," Start with read access. Put destructive tools behind a separate scope so a user can approve reading without approving deleting. The spec's scope guidance tells clients to request only what they need, and lets your server say which scope a request requires.",[325,987,988,991],{},[17,989,990],{},"Don't forward tokens."," Your MCP server should authenticate to your API as itself or with a token issued for that API, not with a copy of the one it was handed.",[325,993,994,997],{},[17,995,996],{},"Return the right errors."," 401 for a missing or invalid token, 403 for insufficient scope.",[325,999,1000,1003],{},[17,1001,1002],{},"Log every tool call"," with the user, the tool, a timestamp and the outcome, but never log token values.",[325,1005,1006,1009],{},[17,1007,1008],{},"Make revocation easy."," Users should be able to disconnect an assistant from your settings page, and an admin should be able to cut off a user at once. Short-lived access tokens limit how long a leaked one is useful.",[325,1011,1012,1015],{},[17,1013,1014],{},"Keep secrets out of URLs."," Both the spec and Claude's documentation say no tokens in query strings.",[31,1017,1019],{"id":1018},"when-to-get-help","When to get help",[14,1021,1022,1023,1025],{},"If you have a documented REST API and want an MCP server over it, App369 builds one at a fixed price: the ",[39,1024,752],{"href":751}," is $2,500 for up to 8 tools over your existing API, with API-key or personal-access-token auth, deployed to your own cloud account, tested in Claude and ChatGPT, with a directory-submission packet. OAuth sign-in is a +$1,000 add-on. Delivery is 10 business days after your API docs and a test key arrive. Directory approval is up to each directory and isn't guaranteed. Simon builds and runs the MCP server for Workspace369, a production Flutter and Firebase SaaS.",[31,1027,1029],{"id":1028},"frequently-asked-questions","Frequently Asked Questions",[47,1031,1033],{"id":1032},"does-an-mcp-server-need-oauth","Does an MCP server need OAuth?",[14,1035,1036],{},"No. The MCP specification says authorization is optional. But if a remote HTTP server wants to work with standard clients that sign users in, the spec's authorization flow is OAuth-based. Local stdio servers are expected to read credentials from the environment instead.",[47,1038,1040],{"id":1039},"can-i-use-an-api-key-for-a-remote-mcp-server","Can I use an API key for a remote MCP server?",[14,1042,1043],{},"Yes, technically. A server can read a key from a request header. Claude documents a beta option where an organization Owner enters a key once, but it treats that key as the organization's credential. For per-user access, use OAuth.",[47,1045,1047],{"id":1046},"what-is-protected-resource-metadata","What is protected resource metadata?",[14,1049,1050,1051,1053],{},"It is a JSON document, defined in RFC 9728, that tells a client which authorization server protects your MCP server. The MCP spec requires servers to publish it, and to point to it in the ",[88,1052,822],{}," header of a 401 response.",[47,1055,1057],{"id":1056},"do-i-need-dynamic-client-registration","Do I need Dynamic Client Registration?",[14,1059,1060],{},"It depends on the revision. The 2025-06-18 spec recommended it; the 2026-07-28 revision prefers Client ID Metadata Documents and marks Dynamic Client Registration as deprecated, kept for compatibility. Claude supports both, and ChatGPT prefers Client ID Metadata Documents but still supports registration.",[47,1062,1064],{"id":1063},"how-should-i-revoke-access","How should I revoke access?",[14,1066,1067],{},"Issue per-user tokens, keep access tokens short-lived, and let users and admins disconnect a client from your settings. Revoking one user's grant should not affect anyone else.",{"title":652,"searchDepth":653,"depth":653,"links":1069},[1070,1071,1072,1073,1074,1075,1076],{"id":760,"depth":653,"text":761},{"id":785,"depth":653,"text":786},{"id":863,"depth":653,"text":864},{"id":922,"depth":653,"text":923},{"id":967,"depth":653,"text":968},{"id":1018,"depth":653,"text":1019},{"id":1028,"depth":653,"text":1029,"children":1077},[1078,1079,1080,1081,1082],{"id":1032,"depth":658,"text":1033},{"id":1039,"depth":658,"text":1040},{"id":1046,"depth":658,"text":1047},{"id":1056,"depth":658,"text":1057},{"id":1063,"depth":658,"text":1064},"2026-10-12T18:00:00.000Z","How should users sign in to your remote MCP server? What the MCP spec requires, when API keys are enough, and what Claude and ChatGPT expect today.",{"readingTimeStats":1086},{"text":1087,"minutes":1088,"time":1089,"words":1090},"8 min read",7.705,462300,1541,"/blog/mcp-server-authentication-api-keys-vs-oauth-2026","8 min",{"title":735,"description":1084},"blog/mcp-server-authentication-api-keys-vs-oauth-2026","mcp server authentication, mcp oauth, remote mcp server, mcp api key, protected resource metadata, claude connectors, chatgpt apps","https://app369.com/blog/mcp-server-authentication-api-keys-vs-oauth-2026/","v6m-fr_cMRT6c2AubzDpFN-NXM21qpN0xjPwMa-WaBk",{"id":1099,"title":1100,"author":1101,"body":1103,"category":669,"createdAt":670,"description":1529,"disclosure":672,"extension":673,"faq":1530,"howTo":672,"location":687,"meta":1543,"navigation":694,"ogImage":672,"path":1549,"primaryKeyword":1550,"readingTime":1551,"related":1552,"seo":1556,"sources":1557,"stem":1588,"tags":1589,"takeaways":1590,"updatedAt":670,"url":1596,"__hash__":1597},"blog/blog/parse-kinvey-backend-as-a-service-alternatives-2026.md","Parse, Kinvey and Realm Sync Are Gone: Where to Run Your App Backend in 2026",{"name":7,"social":1102},{"twitter":9},{"type":11,"value":1104,"toc":1522},[1105,1111,1114,1118,1266,1269,1273,1412,1415,1419,1451,1455,1458,1496,1498,1501],[14,1106,1107,1110],{},[17,1108,1109],{},"If your app was built on Parse, Kinvey, Telerik Platform or Realm Sync, that backend is gone, and links to the old docs now lead nowhere."," In 2026, the realistic homes for a mobile app backend are Firebase, Supabase, Parse Server (self-hosted or hosted on Back4App), Appwrite and PocketBase. The safest choice is the one you could leave, because every service on the list below was once someone's safe choice.",[14,1112,1113],{},"This guide replaces the migration posts and vendor pages that used to answer \"where do I go after Parse?\" Every date below comes from the vendor's own announcement, and every price was checked on the vendor's pricing page on October 17, 2026.",[31,1115,1117],{"id":1116},"what-shut-down-and-when","What shut down, and when",[55,1119,1120,1135],{},[58,1121,1122],{},[61,1123,1124,1127,1130,1133],{},[64,1125,1126],{},"Service",[64,1128,1129],{},"What happened",[64,1131,1132],{},"Date",[64,1134,144],{},[71,1136,1137,1158,1179,1199,1220,1241],{},[61,1138,1139,1145,1148,1151],{},[76,1140,1141,1144],{},[17,1142,1143],{},"Parse"," (Facebook)",[76,1146,1147],{},"Hosted service retired after a one-year wind-down. Parse Server and a database migration tool were released as open source.",[76,1149,1150],{},"Announced January 28, 2016. Retired January 28, 2017",[76,1152,1153],{},[39,1154,1157],{"href":1155,"rel":1156},"https://web.archive.org/web/20160128222249/http://blog.parse.com/announcements/moving-on/",[43],"Parse blog, \"Moving On\"",[61,1159,1160,1166,1169,1172],{},[76,1161,1162,1165],{},[17,1163,1164],{},"Kinvey"," (Progress)",[76,1167,1168],{},"Bought by Progress. Today kinvey.com has no website address in DNS, and progress.com/kinvey redirects to a community page that returns a 404",[76,1170,1171],{},"Acquisition announced June 28, 2017. Links checked October 17, 2026",[76,1173,1174],{},[39,1175,1178],{"href":1176,"rel":1177},"https://www.progress.com/blogs/progress-acquires-the-leading-provider-of-backend-as-a-service",[43],"Progress",[61,1180,1181,1186,1189,1192],{},[76,1182,1183,1165],{},[17,1184,1185],{},"Telerik Platform and AppBuilder",[76,1187,1188],{},"Retired, with a notice telling users how to recover their apps and data",[76,1190,1191],{},"May 10, 2018",[76,1193,1194],{},[39,1195,1198],{"href":1196,"rel":1197},"https://www.npmjs.com/package/appbuilder",[43],"Progress notice on npm",[61,1200,1201,1207,1210,1213],{},[76,1202,1203,1206],{},[17,1204,1205],{},"Atlas Device Sync and Realm-based Device SDKs"," (MongoDB)",[76,1208,1209],{},"Deprecated, then removed. The on-device database continues as open source, without sync",[76,1211,1212],{},"Deprecated September 2024. Removed September 30, 2025",[76,1214,1215],{},[39,1216,1219],{"href":1217,"rel":1218},"https://www.mongodb.com/docs/atlas/device-sdks/deprecation/",[43],"MongoDB",[61,1221,1222,1228,1231,1234],{},[76,1223,1224,1227],{},[17,1225,1226],{},"Visual Studio App Center"," (Microsoft)",[76,1229,1230],{},"Retired, including the hosted CodePush service. Analytics and Diagnostics are extended",[76,1232,1233],{},"March 31, 2025. Analytics and Diagnostics run until the end of March 2027",[76,1235,1236],{},[39,1237,1240],{"href":1238,"rel":1239},"https://learn.microsoft.com/en-us/appcenter/retirement",[43],"Microsoft",[61,1242,1243,1249,1256,1259],{},[76,1244,1245,1248],{},[17,1246,1247],{},"Firebase Dynamic Links"," (Google)",[76,1250,1251,1252,1255],{},"Shut down. Clicked links now return a 404 (",[39,1253,1254],{"href":500},"what replaced it",")",[76,1257,1258],{},"August 25, 2025",[76,1260,1261],{},[39,1262,1265],{"href":1263,"rel":1264},"https://firebase.google.com/support/dynamic-links-faq",[43],"Firebase FAQ",[14,1267,1268],{},"The pattern is the same each time. A hosted service that is not the vendor's main business gets folded into something else or switched off, often with a year or more of notice. Apps that kept their data in standard formats, and their logic in their own code, moved in weeks. Apps that leaned on vendor-only features had to be rebuilt.",[31,1270,1272],{"id":1271},"the-2026-options-compared","The 2026 options compared",[55,1274,1275,1296],{},[58,1276,1277],{},[61,1278,1279,1282,1285,1288,1291,1294],{},[64,1280,1281],{},"Backend",[64,1283,1284],{},"Database",[64,1286,1287],{},"Open source",[64,1289,1290],{},"Free tier (checked October 17, 2026)",[64,1292,1293],{},"First paid tier",[64,1295,141],{},[71,1297,1298,1320,1342,1363,1390],{},[61,1299,1300,1305,1308,1311,1314,1317],{},[76,1301,1302],{},[17,1303,1304],{},"Firebase",[76,1306,1307],{},"Firestore (NoSQL)",[76,1309,1310],{},"No",[76,1312,1313],{},"Spark plan, no payment method needed. Firestore: 1 GiB stored, 50K reads, 20K writes and 20K deletes a day",[76,1315,1316],{},"Blaze, pay as you go (Spark's free usage is included)",[76,1318,1319],{},"Google-managed apps, push via FCM, offline-first mobile",[61,1321,1322,1327,1330,1333,1336,1339],{},[76,1323,1324],{},[17,1325,1326],{},"Supabase",[76,1328,1329],{},"PostgreSQL",[76,1331,1332],{},"Yes (Apache-2.0)",[76,1334,1335],{},"500 MB database, 50,000 monthly active users, 2 active projects, paused after 1 week of inactivity",[76,1337,1338],{},"Pro from $25 a month, including $10 of compute credit",[76,1340,1341],{},"SQL data, row-level security, teams who may self-host later",[61,1343,1344,1349,1352,1354,1357,1360],{},[76,1345,1346],{},[17,1347,1348],{},"Parse Server",[76,1350,1351],{},"MongoDB 7–8 or PostgreSQL 16–18",[76,1353,1332],{},[76,1355,1356],{},"Free to self-host. Back4App's hosted free plan: 25K requests a month, 250 MB of data, 1 GB of files",[76,1358,1359],{},"Back4App MVP at $15 per app a month, billed annually",[76,1361,1362],{},"Old Parse apps, and teams who want the Parse SDKs",[61,1364,1365,1370,1373,1376,1379,1387],{},[76,1366,1367],{},[17,1368,1369],{},"Appwrite",[76,1371,1372],{},"Its own database API",[76,1374,1375],{},"Yes (BSD-3-Clause)",[76,1377,1378],{},"Free cloud plan, or self-host",[76,1380,1381,1382],{},"See ",[39,1383,1386],{"href":1384,"rel":1385},"https://appwrite.io/pricing",[43],"appwrite.io/pricing",[76,1388,1389],{},"Self-hosted auth, database, storage and functions in one box",[61,1391,1392,1397,1400,1403,1406,1409],{},[76,1393,1394],{},[17,1395,1396],{},"PocketBase",[76,1398,1399],{},"SQLite, in one Go binary",[76,1401,1402],{},"Yes (MIT)",[76,1404,1405],{},"Self-host only",[76,1407,1408],{},"Your own server",[76,1410,1411],{},"Small apps, internal tools, prototypes",[14,1413,1414],{},"Two notes on that table. Parse Server is very much alive: the Parse community shipped version 9.10.5 on October 16, 2026, and it runs on Node.js 22 and 24 (Node 20 reached end of life in April 2026). PocketBase is still pre-1.0 (v0.40.5, released October 8, 2026), so expect breaking changes between versions.",[31,1416,1418],{"id":1417},"how-to-choose","How to choose",[342,1420,1421,1427,1433,1439,1445],{},[325,1422,1423,1426],{},[17,1424,1425],{},"You have an old Parse app."," Run Parse Server. Your client SDK calls keep working with few code changes, which was the whole point of the open-source release. Self-host it if you have someone to run MongoDB or PostgreSQL. Otherwise use a hosted Parse provider.",[325,1428,1429,1432],{},[17,1430,1431],{},"You are starting a new mobile app and want the least operations work."," Firebase or Supabase. Choose Firebase for NoSQL documents, Firebase Cloud Messaging and offline persistence. Choose Supabase if your data is relational, if you want SQL, or if you might self-host later.",[325,1434,1435,1438],{},[17,1436,1437],{},"You are leaving Realm Device Sync."," Keep the open-source on-device database if you only needed local storage. If you needed sync, move to a backend that syncs, then test offline edits, conflict handling and reconnects on real devices before you switch users over.",[325,1440,1441,1444],{},[17,1442,1443],{},"You must keep data on your own servers."," Appwrite or Parse Server for a full backend, PocketBase for a small one.",[325,1446,1447,1450],{},[17,1448,1449],{},"You were burned by a shutdown before."," Prefer open source, standard databases (PostgreSQL, MongoDB) and your own domain for every URL your app depends on. Firebase Dynamic Links showed that links on a vendor's domain die with the vendor's product.",[31,1452,1454],{"id":1453},"migrating-off-a-dead-or-dying-backend","Migrating off a dead or dying backend",[14,1456,1457],{},"A backend migration is usually smaller than it looks, if you do it in this order:",[342,1459,1460,1466,1472,1478,1484,1490],{},[325,1461,1462,1465],{},[17,1463,1464],{},"List what the old backend actually did."," Sign-in methods, database tables or collections, file storage, push notifications, scheduled jobs, server-side code (Parse called it Cloud Code) and any webhooks. This list is your scope.",[325,1467,1468,1471],{},[17,1469,1470],{},"Export the data first."," Move the records into a database you control, then point the old API at it if you still can. Parse's own migration tool worked this way, with no downtime.",[325,1473,1474,1477],{},[17,1475,1476],{},"Move files separately."," File storage is often not part of a database export. Copy the files and rewrite their URLs.",[325,1479,1480,1483],{},[17,1481,1482],{},"Plan sign-in carefully."," Find out whether password hashes can be exported and imported. If they can't, users will have to reset their passwords, so tell them in advance.",[325,1485,1486,1489],{},[17,1487,1488],{},"Rebuild server-side code as functions."," Cloud Functions on Firebase, Edge Functions on Supabase, Cloud Code on Parse Server.",[325,1491,1492,1495],{},[17,1493,1494],{},"Ship an app update that talks to the new backend, then switch off the old one."," Keep the old endpoints read-only for one release cycle, because some users update late.",[31,1497,616],{"id":615},[14,1499,1500],{},"App369 is Simon Dziak's studio. He builds and runs Workspace369, a production Flutter and Firebase SaaS, so this advice comes from running a live backend, not from a vendor brochure.",[322,1502,1503,1508,1514],{},[325,1504,1505,1506,637],{},"An app that broke when its backend changed: the ",[39,1507,636],{"href":635},[325,1509,1510,1511,1513],{},"Moving data or connecting a new backend to Stripe, a CRM or another system: ",[39,1512,626],{"href":625},", $1,200 fixed price, 5 business days.",[325,1515,1516,1517,1521],{},"Already on Firebase and the bill is climbing: the ",[39,1518,1520],{"href":1519},"/fixed-price/firebase-cost-audit/","Firebase Cost-Cut Audit",", $750 fixed price, 5 business days.",{"title":652,"searchDepth":653,"depth":653,"links":1523},[1524,1525,1526,1527,1528],{"id":1116,"depth":653,"text":1117},{"id":1271,"depth":653,"text":1272},{"id":1417,"depth":653,"text":1418},{"id":1453,"depth":653,"text":1454},{"id":615,"depth":653,"text":616},"Parse, Kinvey, Telerik Platform, Realm Sync and App Center are gone. A dated record of what shut down, plus the 2026 options for your app backend (Firebase, Supabase, Parse Server, Appwrite, PocketBase) with prices checked October 17, 2026.",[1531,1534,1537,1540],{"question":1532,"answer":1533},"What replaced Parse after it shut down?","Facebook open-sourced Parse Server when it announced the shutdown on January 28, 2016. It is still maintained by the Parse community (version 9.10.5 shipped October 16, 2026) and runs on Node.js with MongoDB or PostgreSQL. You can self-host it or use a hosted Parse provider such as Back4App.",{"question":1535,"answer":1536},"Is Kinvey still available?","Not at its old address. Progress announced it had acquired Kinvey on June 28, 2017. On October 17, 2026, kinvey.com had no website address in DNS, and progress.com/kinvey redirected to a community page that returned a 404. If an app still depends on Kinvey, plan a migration now.",{"question":1538,"answer":1539},"What should I use instead of Realm Device Sync?","MongoDB ended Atlas Device Sync on September 30, 2025. The Realm on-device database continues as open source without sync. For a synced backend, Firebase (Firestore with offline persistence) and Supabase are the common replacements. Test offline behaviour in your own app before you commit.",{"question":1541,"answer":1542},"Firebase or Supabase for a new mobile app?","Firebase if you want Google-managed NoSQL, push notifications and a free Spark plan with no payment method. Supabase if you want PostgreSQL, SQL queries and an open-source stack you can self-host. Supabase Pro starts at $25 a month, and Firebase Blaze is pay as you go.",{"readingTimeStats":1544},{"text":1545,"minutes":1546,"time":1547,"words":1548},"5 min read",4.93,295800,986,"/blog/parse-kinvey-backend-as-a-service-alternatives-2026","parse alternatives","9 min",[1553,1554,1555],"how-to-cut-your-firebase-bill-2026","firebase-security-guide-2026","supabase-permission-denied-new-tables-october-30-2026",{"title":1100,"description":1529},[1558,1560,1563,1565,1567,1569,1571,1573,1576,1579,1582,1585],{"title":1559,"url":1155},"Parse blog, \"Moving On\" (January 28, 2016), Wayback Machine copy",{"title":1561,"url":1562},"Parse Server on GitHub (releases, supported databases)","https://github.com/parse-community/parse-server",{"title":1564,"url":1176},"Progress, \"Progress Acquires the Leading Provider of Backend-as-a-Service\" (June 28, 2017)",{"title":1566,"url":1196},"Progress, Telerik Platform retirement notice on the appbuilder npm package",{"title":1568,"url":1217},"MongoDB, Atlas Device SDKs deprecation",{"title":1570,"url":1263},"Firebase Dynamic Links FAQ (shutdown date)",{"title":1572,"url":1238},"Microsoft, Visual Studio App Center retirement",{"title":1574,"url":1575},"Firebase pricing","https://firebase.google.com/pricing",{"title":1577,"url":1578},"Supabase pricing","https://supabase.com/pricing",{"title":1580,"url":1581},"Back4App backend pricing","https://www.back4app.com/pricing/backend-as-a-service",{"title":1583,"url":1584},"Appwrite on GitHub","https://github.com/appwrite/appwrite",{"title":1586,"url":1587},"PocketBase on GitHub","https://github.com/pocketbase/pocketbase","blog/parse-kinvey-backend-as-a-service-alternatives-2026","parse alternatives, parse.com, kinvey alternatives, telerik platform, backend as a service, baas, parse server, firebase vs supabase, realm device sync end of life, mbaas, mobile backend",[1591,1592,1593,1594,1595],"Parse was retired on January 28, 2017. Its open-source successor, Parse Server, is still maintained: version 9.10.5 shipped on October 16, 2026.","Progress bought Kinvey in 2017 and retired Telerik Platform on May 10, 2018. As of October 17, 2026, kinvey.com has no website and progress.com/kinvey ends in a 404.","MongoDB removed Atlas Device Sync and the Realm-based Device SDKs on September 30, 2025. The on-device database lives on as open source, without sync.","For a new app in 2026, the realistic choices are Firebase, Supabase, Parse Server (self-hosted or on Back4App), Appwrite and PocketBase.","Pick the one you could leave. An open-source backend you can self-host protects you from the next shutdown.","https://app369.com/blog/parse-kinvey-backend-as-a-service-alternatives-2026/","jTTJzXG6QuY8wwAMmhyr_k4fYtvVes6GV33SSvZ41-E",{"id":1599,"title":1600,"author":1601,"body":1603,"category":669,"createdAt":670,"description":2298,"disclosure":672,"extension":673,"faq":2299,"howTo":672,"location":687,"meta":2315,"navigation":694,"ogImage":672,"path":2320,"primaryKeyword":2321,"readingTime":1551,"related":2322,"seo":2325,"sources":2326,"stem":2370,"tags":2371,"takeaways":2372,"updatedAt":670,"url":2378,"__hash__":2379},"blog/blog/firebase-dynamic-links-shutdown-deep-linking-2026.md","Deep Linking in 2026: What Replaced Firebase Dynamic Links and How to Set It Up",{"name":7,"social":1602},{"twitter":9},{"type":11,"value":1604,"toc":2289},[1605,1611,1614,1618,1658,1661,1665,1668,1689,1692,1709,1712,1716,1843,1846,1848,1883,1886,1890,1893,1923,2024,2049,2125,2128,2203,2206,2210,2237,2240,2265,2268,2270,2272,2285],[14,1606,1607,1610],{},[17,1608,1609],{},"A deep link is a link that opens a specific screen inside a mobile app, not just the app's front door. Firebase Dynamic Links, the free Google service many apps used for this, shut down on August 25, 2025."," In 2026 you have two real choices. Use Universal Links and Android App Links on your own domain for free, or pay a provider such as Branch, AppsFlyer, Adjust or Airbridge if you need links that survive an app install.",[14,1612,1613],{},"This guide replaces the older deep linking explainers and vendor docs that no longer load. Every date and price below comes from the vendor's own page, checked on October 17, 2026.",[31,1615,1617],{"id":1616},"what-deep-linking-means-in-plain-words","What deep linking means, in plain words",[322,1619,1620,1626,1636,1646,1652],{},[325,1621,1622,1625],{},[17,1623,1624],{},"Deep link."," A link that goes to a place inside an app, such as a product, an invoice or an invite. A normal link opens the app's home screen at best.",[325,1627,1628,1631,1632,1635],{},[17,1629,1630],{},"Universal Links (iOS)."," Apple's version. You tap a normal https link, and iOS opens your app if it is installed. If not, the link opens in the browser. Apple checks a file on your website, called ",[88,1633,1634],{},"apple-app-site-association",", to confirm the link belongs to your app.",[325,1637,1638,1641,1642,1645],{},[17,1639,1640],{},"Android App Links."," Google's version. Same idea. Android checks a file called ",[88,1643,1644],{},"assetlinks.json"," on your website.",[325,1647,1648,1651],{},[17,1649,1650],{},"Deferred deep link."," A link that works even when the app is not installed yet. The user taps, installs the app from the store, and lands on the right screen on first open. This is what Dynamic Links did well, and it is the part plain Universal Links and App Links do not do.",[325,1653,1654,1657],{},[17,1655,1656],{},"Click analytics."," Counts of who clicked which link. Dynamic Links had some. Google's migration guide offers no replacement for it.",[14,1659,1660],{},"Marketers mostly care about the last two. Developers mostly care about the first three.",[31,1662,1664],{"id":1663},"what-happened-to-firebase-dynamic-links","What happened to Firebase Dynamic Links",[14,1666,1667],{},"Google's own FAQ says Dynamic Links shut down on August 25, 2025. This is what that means for old links:",[322,1669,1670,1673,1676,1683,1686],{},[325,1671,1672],{},"Every clicked link returns an HTTP 404 to the user.",[325,1674,1675],{},"Short link creation and link stats API calls return 400 or 403 errors.",[325,1677,1678,1679,1682],{},"Existing ",[88,1680,1681],{},".page.link"," domains cannot be kept or transferred. Domain and link data is marked for deletion on the shutdown date.",[325,1684,1685],{},"The SDKs will not crash your app by themselves, but your code has to handle the new responses. For example, on iOS, short link creation now returns a 403, and first-open attribution returns empty data.",[325,1687,1688],{},"Email link sign-in, password reset and email verification on mobile needed updated SDKs. Google has separate guides for iOS and Android.",[14,1690,1691],{},"Google's own advice, in its FAQ:",[342,1693,1694,1697,1700,1703],{},[325,1695,1696],{},"If you need full feature parity, use a third-party provider. The FAQ names Adjust, Airbridge, AppsFlyer, Bitly, Branch, Kochava and Singular, and says Google has not vetted them.",[325,1698,1699],{},"If you only need to open an installed app, use Universal Links and App Links. The official migration guide covers this path.",[325,1701,1702],{},"If you no longer need the links, review them, delete the URL prefixes and remove the SDK.",[325,1704,1705,1706,45],{},"Export your link metadata, and if you keep a custom domain, update your rewrite rules in ",[88,1707,1708],{},"firebase.json",[14,1710,1711],{},"The migration guide is honest about the gap. Universal Links and App Links do not send users to the app store, and do not carry the journey through a first install. For iOS it recommends Smart App Banners as the closest substitute.",[31,1713,1715],{"id":1714},"what-to-use-now","What to use now",[55,1717,1718,1734],{},[58,1719,1720],{},[61,1721,1722,1725,1728,1731],{},[64,1723,1724],{},"Option",[64,1726,1727],{},"Deferred deep linking",[64,1729,1730],{},"Click analytics",[64,1732,1733],{},"Price (checked October 17, 2026)",[71,1735,1736,1750,1770,1790,1809,1828],{},[61,1737,1738,1743,1745,1747],{},[76,1739,1740],{},[17,1741,1742],{},"Universal Links + App Links on your own domain",[76,1744,1310],{},[76,1746,1310],{},[76,1748,1749],{},"Free. You pay for your domain and hosting.",[61,1751,1752,1757,1760,1762],{},[76,1753,1754],{},[17,1755,1756],{},"Branch",[76,1758,1759],{},"Yes",[76,1761,1759],{},[76,1763,1764,1765],{},"Basics plan: free trial, no price shown. Essentials and Enterprise: \"Request a demo.\" See ",[39,1766,1769],{"href":1767,"rel":1768},"https://www.branch.io/pricing/",[43],"branch.io/pricing",[61,1771,1772,1777,1780,1782],{},[76,1773,1774],{},[17,1775,1776],{},"AppsFlyer (OneLink)",[76,1778,1779],{},"Yes, from the Standard plan (Zero is free but has no deferred linking)",[76,1781,1759],{},[76,1783,1784,1785],{},"Deep Linking plans: Zero is labelled \"Free.\" Standard, Advanced and Premium show \"Custom pricing\" with \"Request a demo.\" See ",[39,1786,1789],{"href":1787,"rel":1788},"https://www.appsflyer.com/pricing/deep-linking",[43],"appsflyer.com/pricing/deep-linking",[61,1791,1792,1797,1799,1801],{},[76,1793,1794],{},[17,1795,1796],{},"Adjust",[76,1798,1759],{},[76,1800,1759],{},[76,1802,1381,1803,1808],{},[39,1804,1807],{"href":1805,"rel":1806},"https://www.adjust.com/pricing/",[43],"adjust.com/pricing",". Its pricing page would not load for us on October 17, so we are not quoting a number.",[61,1810,1811,1816,1818,1820],{},[76,1812,1813],{},[17,1814,1815],{},"Airbridge",[76,1817,1759],{},[76,1819,1759],{},[76,1821,1822,1823],{},"Core plan: $40+ a month after a 30-day free trial, deep linking included. Growth plan: custom. See ",[39,1824,1827],{"href":1825,"rel":1826},"https://www.airbridge.io/pricing",[43],"airbridge.io/pricing",[61,1829,1830,1835,1838,1840],{},[76,1831,1832],{},[17,1833,1834],{},"Bitly, Kochava, Singular",[76,1836,1837],{},"Check each vendor",[76,1839,1837],{},[76,1841,1842],{},"Named in Google's FAQ. Prices not checked here, so see each vendor's pricing page.",[14,1844,1845],{},"Two cautions on that table. First, \"deferred\" and \"analytics\" here are what these vendors sell in general. Test the exact features on the plan you are quoted. Second, several of these tools are attribution platforms first and link tools second. If you only need links, that can be a lot of product to buy.",[31,1847,1418],{"id":1417},[342,1849,1850,1856,1862,1868,1874],{},[325,1851,1852,1855],{},[17,1853,1854],{},"Your users already have the app, and links come from emails, your website or in-app shares."," Use plain Universal Links and App Links. It is free, it is the platform's own mechanism, and no vendor can shut it down.",[325,1857,1858,1861],{},[17,1859,1860],{},"You run paid ads that send new users to the app store."," You need deferred deep linking and attribution. Pick a provider, and ask for a quote that matches your install volume.",[325,1863,1864,1867],{},[17,1865,1866],{},"You are a small team that wants links and little else."," Look at the lowest published tier first (Airbridge Core or AppsFlyer Zero; Zero covers basic routing only), and read what the free or entry plan actually excludes before you commit.",[325,1869,1870,1873],{},[17,1871,1872],{},"You want first-open routing without a vendor."," Combine Universal Links, a Smart App Banner on iOS, and a small server route that remembers the intended screen. It takes some build time, but you own it.",[325,1875,1876,1879,1880,1882],{},[17,1877,1878],{},"You have old Dynamic Links printed or published."," Links on a ",[88,1881,1681],{}," domain are gone for good, because Google will not let anyone keep those domains. If your links used your own custom domain, point that domain at your website and redirect the old paths to the right pages. Either way, publish new links on your own domain.",[14,1884,1885],{},"If you are unsure, start with option 1. You can add a provider later without changing your domain files.",[31,1887,1889],{"id":1888},"set-up-universal-links-and-app-links-on-your-own-domain","Set up Universal Links and App Links on your own domain",[14,1891,1892],{},"Use a domain you control, and use the same domain in every step. Apple and Google both want the files served over HTTPS with no redirects.",[342,1894,1895,1909],{},[325,1896,1897,1900,1901,1904,1905,1908],{},[17,1898,1899],{},"Pick the links."," Decide which paths open the app, for example ",[88,1902,1903],{},"/invite/*"," or ",[88,1906,1907],{},"/invoice/*",". Keep the list short.",[325,1910,1911,1914,1915,1918,1919,1922],{},[17,1912,1913],{},"Create the iOS file."," Host it at ",[88,1916,1917],{},"https://yourdomain.com/.well-known/apple-app-site-association",". The name has no ",[88,1920,1921],{},".json"," extension. Apple's docs say to host it over HTTPS with a valid certificate and no redirects. A minimal version looks like this:",[1924,1925,1929],"pre",{"className":1926,"code":1927,"language":1928,"meta":652,"style":652},"language-json shiki shiki-themes github-light github-dark","{\n  \"applinks\": {\n    \"details\": [\n      {\n        \"appIDs\": [\"TEAMID.com.example.app\"],\n        \"components\": [{ \"/\": \"/invite/*\" }]\n      }\n    ]\n  }\n}\n","json",[88,1930,1931,1940,1949,1957,1963,1979,2000,2006,2012,2018],{"__ignoreMap":652},[1932,1933,1936],"span",{"class":1934,"line":1935},"line",1,[1932,1937,1939],{"class":1938},"sVt8B","{\n",[1932,1941,1942,1946],{"class":1934,"line":653},[1932,1943,1945],{"class":1944},"sj4cs","  \"applinks\"",[1932,1947,1948],{"class":1938},": {\n",[1932,1950,1951,1954],{"class":1934,"line":658},[1932,1952,1953],{"class":1944},"    \"details\"",[1932,1955,1956],{"class":1938},": [\n",[1932,1958,1960],{"class":1934,"line":1959},4,[1932,1961,1962],{"class":1938},"      {\n",[1932,1964,1966,1969,1972,1976],{"class":1934,"line":1965},5,[1932,1967,1968],{"class":1944},"        \"appIDs\"",[1932,1970,1971],{"class":1938},": [",[1932,1973,1975],{"class":1974},"sZZnC","\"TEAMID.com.example.app\"",[1932,1977,1978],{"class":1938},"],\n",[1932,1980,1982,1985,1988,1991,1994,1997],{"class":1934,"line":1981},6,[1932,1983,1984],{"class":1944},"        \"components\"",[1932,1986,1987],{"class":1938},": [{ ",[1932,1989,1990],{"class":1944},"\"/\"",[1932,1992,1993],{"class":1938},": ",[1932,1995,1996],{"class":1974},"\"/invite/*\"",[1932,1998,1999],{"class":1938}," }]\n",[1932,2001,2003],{"class":1934,"line":2002},7,[1932,2004,2005],{"class":1938},"      }\n",[1932,2007,2009],{"class":1934,"line":2008},8,[1932,2010,2011],{"class":1938},"    ]\n",[1932,2013,2015],{"class":1934,"line":2014},9,[1932,2016,2017],{"class":1938},"  }\n",[1932,2019,2021],{"class":1934,"line":2020},10,[1932,2022,2023],{"class":1938},"}\n",[342,2025,2026,2036],{"start":658},[325,2027,2028,2031,2032,2035],{},[17,2029,2030],{},"Add the iOS entitlement."," In Xcode, open Signing & Capabilities, add Associated Domains, and add ",[88,2033,2034],{},"applinks:yourdomain.com",". Use the bare domain, with no path and no trailing slash. Personal development teams cannot use this capability (per Flutter's setup guide).",[325,2037,2038,1914,2041,2044,2045,2048],{},[17,2039,2040],{},"Create the Android file.",[88,2042,2043],{},"https://yourdomain.com/.well-known/assetlinks.json",", with content type ",[88,2046,2047],{},"application/json"," and no redirects:",[1924,2050,2052],{"className":1926,"code":2051,"language":1928,"meta":652,"style":652},"[{\n  \"relation\": [\"delegate_permission/common.handle_all_urls\"],\n  \"target\": {\n    \"namespace\": \"android_app\",\n    \"package_name\": \"com.example.app\",\n    \"sha256_cert_fingerprints\": [\"AA:BB:...:FF\"]\n  }\n}]\n",[88,2053,2054,2059,2071,2078,2091,2103,2116,2120],{"__ignoreMap":652},[1932,2055,2056],{"class":1934,"line":1935},[1932,2057,2058],{"class":1938},"[{\n",[1932,2060,2061,2064,2066,2069],{"class":1934,"line":653},[1932,2062,2063],{"class":1944},"  \"relation\"",[1932,2065,1971],{"class":1938},[1932,2067,2068],{"class":1974},"\"delegate_permission/common.handle_all_urls\"",[1932,2070,1978],{"class":1938},[1932,2072,2073,2076],{"class":1934,"line":658},[1932,2074,2075],{"class":1944},"  \"target\"",[1932,2077,1948],{"class":1938},[1932,2079,2080,2083,2085,2088],{"class":1934,"line":1959},[1932,2081,2082],{"class":1944},"    \"namespace\"",[1932,2084,1993],{"class":1938},[1932,2086,2087],{"class":1974},"\"android_app\"",[1932,2089,2090],{"class":1938},",\n",[1932,2092,2093,2096,2098,2101],{"class":1934,"line":1965},[1932,2094,2095],{"class":1944},"    \"package_name\"",[1932,2097,1993],{"class":1938},[1932,2099,2100],{"class":1974},"\"com.example.app\"",[1932,2102,2090],{"class":1938},[1932,2104,2105,2108,2110,2113],{"class":1934,"line":1981},[1932,2106,2107],{"class":1944},"    \"sha256_cert_fingerprints\"",[1932,2109,1971],{"class":1938},[1932,2111,2112],{"class":1974},"\"AA:BB:...:FF\"",[1932,2114,2115],{"class":1938},"]\n",[1932,2117,2118],{"class":1934,"line":2002},[1932,2119,2017],{"class":1938},[1932,2121,2122],{"class":1934,"line":2008},[1932,2123,2124],{"class":1938},"}]\n",[14,2126,2127],{},"If you use Google Play App Signing, copy the fingerprint from the Play Console (Release, Setup, App signing). The one from your local keystore will usually not match what is on users' phones.",[342,2129,2130,2163,2169],{"start":1965},[325,2131,2132,2135,2136,2139,2140,2143,2144,2147,2148,2151,2152,2155,2156,2159,2160,45],{},[17,2133,2134],{},"Add the Android intent filter."," In ",[88,2137,2138],{},"AndroidManifest.xml",", add an ",[88,2141,2142],{},"intent-filter"," with ",[88,2145,2146],{},"android:autoVerify=\"true\"",", the ",[88,2149,2150],{},"VIEW"," action, the ",[88,2153,2154],{},"DEFAULT"," and ",[88,2157,2158],{},"BROWSABLE"," categories, and ",[88,2161,2162],{},"\u003Cdata android:scheme=\"https\" android:host=\"yourdomain.com\" />",[325,2164,2165,2168],{},[17,2166,2167],{},"Handle the link in your app."," Read the incoming URL and route to the right screen. Do this for both a cold start and an app that is already running.",[325,2170,2171,2174],{},[17,2172,2173],{},"Test before you ship.",[322,2175,2176,2183,2200],{},[325,2177,2178,2179,2182],{},"iOS: Apple fetches your file through its own CDN. Per Apple's docs, the CDN asks for your file within 24 hours, and devices re-check about once a week. You can see what Apple has cached at ",[88,2180,2181],{},"https://app-site-association.cdn-apple.com/a/v1/yourdomain.com",". For a private dev server, Apple's alternate mode bypasses the CDN. Then tap a link from the Notes app on a real device.",[325,2184,2185,2186,2189,2190,2193,2194,2199],{},"Android: run ",[88,2187,2188],{},"adb shell pm get-app-links com.example.app"," and look for ",[88,2191,2192],{},"verified"," next to your domain. Google's ",[39,2195,2198],{"href":2196,"rel":2197},"https://developers.google.com/digital-asset-links/tools/generator",[43],"Statement List Generator and Tester"," can generate and check the file.",[325,2201,2202],{},"We know of no Apple-run web validator for the apple-app-site-association file today, so on iOS rely on the CDN URL above and a real device.",[14,2204,2205],{},"The usual failures are a redirect in front of the file (including www to non-www), the wrong signing fingerprint, a Team ID typo, and testing before Apple's CDN has caught up.",[31,2207,2209],{"id":2208},"flutter-specifics","Flutter specifics",[14,2211,2212,2213,2155,2218,2223,2224,2227,2228,2155,2231,2234,2235,45],{},"Flutter has official guides for both platforms: ",[39,2214,2217],{"href":2215,"rel":2216},"https://docs.flutter.dev/cookbook/navigation/set-up-universal-links",[43],"set up universal links",[39,2219,2222],{"href":2220,"rel":2221},"https://docs.flutter.dev/cookbook/navigation/set-up-app-links",[43],"set up app links",". Per those pages, Flutter 3.27 and later turn deep linking on by default. Older versions need ",[88,2225,2226],{},"FlutterDeepLinkingEnabled"," set to YES in ",[88,2229,2230],{},"Info.plist",[88,2232,2233],{},"flutter_deeplinking_enabled"," set to true in ",[88,2236,2138],{},[14,2238,2239],{},"Two ways to receive links:",[322,2241,2242,2252],{},[325,2243,2244,2247,2248,2251],{},[17,2245,2246],{},"go_router."," Flutter's built-in handling feeds incoming links to the ",[88,2249,2250],{},"Router",". go_router (version 18.1.0 on pub.dev today) is a declarative router built on that system and lists deep linking as a feature. Define your paths as routes, and an incoming link lands on the matching screen.",[325,2253,2254,932,2257,2260,2261,2264],{},[17,2255,2256],{},"app_links.",[88,2258,2259],{},"app_links"," package (7.2.2 today) handles Android App Links, iOS Universal Links and custom schemes. You subscribe to ",[88,2262,2263],{},"AppLinks().uriLinkStream",", which delivers both the first link and later ones. Per Flutter's docs, if you use a plugin like this, set the deep linking flag to false so Flutter's own handler does not conflict.",[14,2266,2267],{},"Flutter DevTools also has a Deep Links validator. It checks website configuration and manifest files, and works for Android and iOS from Flutter 3.27.",[31,2269,616],{"id":615},[14,2271,619],{},[322,2273,2274,2280],{},[325,2275,2276,2277,2279],{},"Links open the wrong screen, or the app never opens from a link: the ",[39,2278,636],{"href":635}," diagnoses one issue for $450 and fixes it for $1,200, both fixed price (the $450 is credited toward the fix).",[325,2281,2282,2283,1513],{},"Connecting a link provider, your backend and a CRM or Stripe: ",[39,2284,626],{"href":625},[2286,2287,2288],"style",{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":652,"searchDepth":653,"depth":653,"links":2290},[2291,2292,2293,2294,2295,2296,2297],{"id":1616,"depth":653,"text":1617},{"id":1663,"depth":653,"text":1664},{"id":1714,"depth":653,"text":1715},{"id":1417,"depth":653,"text":1418},{"id":1888,"depth":653,"text":1889},{"id":2208,"depth":653,"text":2209},{"id":615,"depth":653,"text":616},"What deep linking is, what happened when Firebase Dynamic Links shut down on August 25, 2025, and how to set up Universal Links and Android App Links in 2026. Vendor options and prices checked October 17, 2026.",[2300,2303,2306,2309,2312],{"question":2301,"answer":2302},"When did Firebase Dynamic Links shut down?","On August 25, 2025. Google says all clicked links return an HTTP 404, short link and link stats API calls return 400 or 403 errors, and existing .page.link domains cannot be kept or transferred.",{"question":2304,"answer":2305},"What replaced Firebase Dynamic Links?","Nothing from Google replaced it one for one. Google tells developers to use Universal Links and Android App Links for links that open an installed app, and a third-party deep linking provider for full feature parity. Google names Adjust, Airbridge, AppsFlyer, Bitly, Branch, Kochava and Singular, and says it has not vetted them.",{"question":2307,"answer":2308},"What is a deferred deep link?","A link that still works when the app is not installed yet. The user taps, goes to the app store, installs the app, and lands on the right screen on first open. Universal Links and App Links cannot do this on their own. You need a provider or your own server logic.",{"question":2310,"answer":2311},"Do I need a paid service for deep links?","Not if your users already have the app. Universal Links and App Links cost nothing beyond a domain you own. You need a provider only for deferred deep linking, click analytics, or campaign attribution.",{"question":2313,"answer":2314},"How do I test Universal Links and App Links?","On iOS, check the file through Apple's CDN and tap a link from the Notes app. On Android, use adb pm get-app-links to see whether your domain shows as verified, and Google's Statement List Generator and Tester to check assetlinks.json. For Flutter apps, DevTools has a Deep Links validator.",{"readingTimeStats":2316},{"text":1087,"minutes":2317,"time":2318,"words":2319},7.7,462000,1540,"/blog/firebase-dynamic-links-shutdown-deep-linking-2026","firebase dynamic links alternative",[2323,1554,2324],"mobile-app-analytics-tracking-guide-2026","how-to-debug-a-flutter-firebase-bug-2026",{"title":1600,"description":2298},[2327,2329,2332,2335,2338,2341,2344,2346,2349,2351,2353,2356,2359,2362,2364,2366,2368],{"title":2328,"url":1263},"Firebase Dynamic Links FAQ (shutdown date, link behaviour, recommended alternatives)",{"title":2330,"url":2331},"Firebase, Migrate to App Links and Universal Links (official migration guide)","https://firebase.google.com/support/guides/app-links-universal-links",{"title":2333,"url":2334},"Apple, Supporting associated domains","https://developer.apple.com/documentation/xcode/supporting-associated-domains",{"title":2336,"url":2337},"Apple CDN copy of an apple-app-site-association file (example: www.apple.com)","https://app-site-association.cdn-apple.com/a/v1/www.apple.com",{"title":2339,"url":2340},"Android, Verify Android App Links","https://developer.android.com/training/app-links/verify-android-applinks",{"title":2342,"url":2343},"Android, Configure website associations (assetlinks.json requirements)","https://developer.android.com/training/app-links/configure-assetlinks",{"title":2345,"url":2196},"Google, Statement List Generator and Tester",{"title":2347,"url":2348},"Flutter, Deep linking","https://docs.flutter.dev/ui/navigation/deep-linking",{"title":2350,"url":2215},"Flutter, Set up universal links (iOS)",{"title":2352,"url":2220},"Flutter, Set up app links (Android)",{"title":2354,"url":2355},"Flutter DevTools, Validate deep links","https://docs.flutter.dev/tools/devtools/deep-links",{"title":2357,"url":2358},"app_links package on pub.dev","https://pub.dev/packages/app_links",{"title":2360,"url":2361},"go_router package on pub.dev","https://pub.dev/packages/go_router",{"title":2363,"url":1767},"Branch pricing",{"title":2365,"url":1787},"AppsFlyer deep linking pricing",{"title":2367,"url":1805},"Adjust pricing",{"title":2369,"url":1825},"Airbridge pricing","blog/firebase-dynamic-links-shutdown-deep-linking-2026","firebase dynamic links alternative, deep linking, deferred deep linking, universal links, android app links, apple-app-site-association, assetlinks.json, branch alternatives, appsflyer onelink, flutter deep linking, mobile deep linking",[2373,2374,2375,2376,2377],"Firebase Dynamic Links shut down on August 25, 2025. Clicked links now return an HTTP 404, and Google says the .page.link domains cannot be kept or transferred.","Google names two routes. Use Universal Links and Android App Links if you only need links to open an installed app. Use a third-party provider if you need full feature parity.","Universal Links and App Links are free and live on your own domain. They do not do deferred deep linking, and they do not give you click analytics.","Two files make it work: /.well-known/apple-app-site-association on iOS and /.well-known/assetlinks.json on Android. Serve both over HTTPS with no redirects.","Pricing as of October 17, 2026: Airbridge Core is $40+ a month, AppsFlyer has a free Zero plan, Branch and the paid AppsFlyer plans are sales-led, and Adjust lists no price we could read.","https://app369.com/blog/firebase-dynamic-links-shutdown-deep-linking-2026/","kWZsntPKkyZ0cbGNktuWgqusyXrXGdyedktgEIg6sDo",[2381,2383,2386,2389,2392,2395],{"keyword":5,"url":730,"title":5,"relevance":2382},75,{"keyword":2384,"url":2385,"title":2384,"relevance":2008},"App Development Vendor Evaluation Checklist (2026)","https://app369.com/blog/app-development-vendor-evaluation-checklist-2026/",{"keyword":2387,"url":2388,"title":2387,"relevance":2008},"Best Mobile App Development Companies in 2026","https://app369.com/blog/best-app-development-company-mobile-apps-2026/",{"keyword":2390,"url":2391,"title":2390,"relevance":2008},"App Development Pricing: Current Market Trends","https://app369.com/blog/app-development-pricing-and-market-trends/",{"keyword":2393,"url":2394,"title":2393,"relevance":2002},"InVision Shut Down: What to Use to Design and Prototype a Mobile App in 2026","https://app369.com/blog/invision-shut-down-app-prototyping-tools-2026/",{"keyword":2396,"url":2397,"title":2396,"relevance":1981},"Best Ecommerce App Development Company (2026)","https://app369.com/blog/best-app-development-company-ecommerce-2026/",1792231608337]