SG Payment Deep Link Test (Android)

Tap-test sandbox for which Singapore payment-app deep links open which screen. App Link rows = verified-domain https URLs; Android intent rows = intent://… URIs targeting the app's package. See the Findings card below for what's possible and what isn't.
× Last attempt failed —

Test parameters

detecting… UA
How to test: tap a button. If the app opens, that variant works. If you stay in Chrome (either landing on the app's website or seeing a red banner appear at the top of this page), that variant doesn't route to the installed app.
App Link path patterns are guesses — assetlinks.json proves only the domain is verified by the app, not which paths under that domain the app's manifest has registered. Try each one.
Chrome strips action=MAIN from web-originated intents, so "open this app like tapping its icon" isn't possible from a web page — every working deep link must target a specific <intent-filter>.

Findings — what's actually possible

DBS PayLah! — only the ?txnref=… path opens the payment screen. PayLah's intent-filter is scheme + host only (dbspaylah://com.dbs.paylah/*) and the in-app URI handler only processes the txnref query param. That token is DBS-server-signed and time-limited; we tested 12+ alternate hosts and paths (/scan, /qr, /transfer, /pay, /paynow, /send, scanqr, scanandpay, bare, etc.) — every one either fails no-match or opens PayLah to home with params silently discarded.

OCBC Digital, UOB TMRW — no Android App Link verification on any public domain, custom schemes don't resolve. Deliberately not exposed.

By design, not oversight. Free-form deep-link-driven payment prefill doesn't exist on any SG bank app: if dbspaylah://?mid=X&amount=Y popped a payment screen, anyone could phish-link a victim into paying an attacker's MID. Merchant data only enters the apps via (a) the camera scanner — a deliberate physical user action — or (b) a server-signed transaction reference issued via a merchant agreement.

Feasible workarounds:

  • DBS PayLah Merchant API — B2B contract; your backend mints a real tranRef, share the URL, user taps → prefilled screen opens. The only supported way to deep-link into PayLah with arbitrary amount + recipient.
  • PayNow SGQR — render an EMVCo PayNow QR (the standard SG QR format). Recipient scans with any SG bank app (DBS, OCBC, UOB, SCB, Citi, Maybank…) and lands on a prefilled transfer screen. No per-bank deal required.
  • PSP integration — Stripe / Adyen / 2C2P with PayNow / GrabPay / NETS as web-checkout payment methods. Browser flow, not a bank-app deep link.
  • Per-bank merchant APIs — OCBC, UOB have B2B equivalents to DBS's Merchant API. Same shape: backend signs, app validates.

Activity log

No attempts yet — tap a button above.