app-clips

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Starting in iOS 15.4, the full app can access keychain items created by its corresponding App Clip when the App Clip and full app have the correct association entitlements. This is one-way: the App Cl

Audit 0.4.1 · source sha 8c7069c512a0 · 24 Oct 2026Report an issue or request a re-scan

• Publisherdpearson2699 GitHub userOwner of the repository this skill is read from
• Source folderdpearson2699/swift-ios-skills/skills/app-clipsThe exact folder we audited
• LicenceNOASSERTIONAs the repository states it
• Commit pinned for this verdict8c7069c512a0A new audit runs when the source changes
• Repository statusNot archivedLast push 84 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Build iOS App Clips with invocation URLs, App Clip Codes, NFC, QR codes, Safari banners, Maps, Messages, target setup, App Store Connect experiences, size/capability constraints, NSUserActivity routing, SKOverlay…

---
name: app-clips
description: "Build iOS App Clips with invocation URLs, App Clip Codes, NFC, QR codes, Safari banners, Maps, Messages, target setup, App Store Connect experiences, size/capability constraints, NSUserActivity routing, SKOverlay promotion, App Group/keychain handoff, ephemeral notifications, location confirmation, and full-app migration. Use when creating App Clips or wiring App Clip invocation, experience configuration, or full-app handoff."
---

# App Clips

Build lightweight, instantly available versions of an iOS app for focused in-the-moment experiences or demos.

## Contents

- [App Clip Target Setup](#app-clip-target-setup)
- [Invocation and Experience Routing](#invocation-and-experience-routing)
- [Size and Capability Decisions](#size-and-capability-decisions)
- [Data, Notifications, and Location](#data-notifications-and-location)
- [Common Mistakes](#common-mistakes)
- [Review Checklist](#review-checklist)
- [References](#references)

## App Clip Target Setup

An App Clip is a **separate target** in the same Xcode project as your full app:

1. **File → New → Target → App Clip** — Xcode creates the App Clip target, adds the **Embed App Clip** build phase to the full app target, and wires the association entitlements.
2. The App Clip bundle ID **must** be prefixed by the full app's bundle ID: `com.example.MyApp.Clip`.
3. Verify raw entitlement keys when diagnosing archive, signing, or App Store Connect failures:
   - App Clip target: `com.apple.developer.on-demand-install-capable`
   - App Clip target parent app link: `com.apple.developer.parent-application-identifiers`
   - Full app target associated App Clip link: `com.apple.developer.associated-appclip-app-identifiers`

Use Swift packages or shared source files for code needed by both targets. Add App Clip-specific compile branches with the `APPCLIP` active compilation condition, and avoid linking full-app-only frameworks into the App Clip target.

**Validation checkpoint:** Archive both targets and inspect their archived
entitlements. If signing or validation fails, correct the three raw key/target
assignments above and rearchive until both pass.

## Invocation and Experience Routing

Read [`references/routing-and-experiences.md`](references/routing-and-experiences.md) when implementing invocation URL routing, App Store Connect experiences, Local Experiences, Safari Smart App Banners, QR/NFC/App Clip Codes, AASA, or associated domains.

App Clips receive `NSUserActivityTypeBrowsingWeb` activities. Keep the invocation router shared with the full app because, after installation, the full app replaces the App Clip and receives future invocations.

- SwiftUI: use `.onContinueUserActivity(NSUserActivityTypeBrowsingWeb)`.
- UIKit cold launch: inspect `connectionOptions.userActivities` in `scene(_:willConnectTo:options:)`.
- UIKit continuation: handle the actual `NSUserActivity` in `scene(_:continue:)`.
- `scene(_:willContinueUserActivityWithType:)` is only advance notice and does not provide the URL.

Configure the required default App Clip experience in App Store Connect. Use advanced experiences for Maps integration, location association, production App Clip Codes, per-location cards, and precise physical-place routing; demo App Clip Codes can use the short demo App Clip link.

For custom URLs, add `appclips:example.com` to Associated Domains on both the full app and App Clip targets, and host an AASA file with the App Clip app identifier. For Safari banners, use `app-id`, `app-clip-bundle-id`, and optional `app-clip-display=card`; do not rely on `app-argument` for App Clip launches.

**Validation checkpoint:** Exercise each URL with `_XCAppClipURL` and a Local
Experience, fix routing/AASA/experience mismatches, and repeat until the App
Clip and installed full app reach the same destination.

## Size and Capability Decisions

Use [Size, capabilities, and promotion](references/size-capabilities-and-promotion.md)
as the authoritative checklist for feasibility reviews, size tiers and measurement,
Background Assets, CloudKit, Live Activities, unsupported features, and full-app
promotion. Load it whenever any of those topics is in scope.

Keep product reviews at the boundary level: state the size basis, invocation and
download fit, capability exclusions, and handoff destination. Add implementation
APIs only when the user asks for implementation.

## Data, Notifications, and Location

Read [`references/data-handoff-notifications-location.md`](references/data-handoff-notifications-location.md) when implementing App Group/full-app migration, keychain or Sign in with Apple handoff, ephemeral notifications, notification relaunch routing, or physical location confirmation.

Treat App Group storage as non-secret handoff state, not a trust boundary. The
reference owns the iOS 15.4+ one-way keychain rule, Sign in with Apple
verification, ephemeral-notification permission and relaunch routing, and
physical-location confirmation—including their required raw keys and targets.

## Common Mistakes

### Exceeding the applicable App Clip size limit

Choose and measure the applicable limit using
[Size Limits](references/size-capabilities-and-promotion.md#size-limits).

### Designing a marketing-only or web-view-heavy App Clip

App Clips should let people complete a focused task or full demo without installing the app. Avoid marketing-only clips, ad-heavy flows, splash screens, launch-blocking downloads, repeated install prompts, and web-view-heavy experiences that would work better as a website.

## Review Checklist

Do not ship until every applicable gate passes; fix failures and rerun the same gate.

- [ ] Target IDs, all three raw entitlement keys, and shared-code boundaries are correct.
- [ ] Invocation works for SwiftUI/UIKit cold launch and continuation, then hands off to the full app.
- [ ] Associated domains, AASA, App Store Connect experiences, and local invocation tests pass.
- [ ] Size, capability, UX, Live Activity, and pr

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/dpearson2699/swift-ios-skills
git -C swift-ios-skills checkout 8c7069c512a0

Works in

1. 2026-10-24
   ✓SAFE B 89 / 100

   first audit · source 8c7069c512a0

Questions about app-clips

• github.com/dpearson2699/swift-ios-skills/tree/main/skills/app-cl — the audited source at commit 8c7069c512a0 and every finding aboveObserved · 24 Oct 2026

Spotted something wrong? Report a correction · Methodology