Deep links

A deep link is a URL that opens something inside GROM instead of in a browser. They all live on code.casinoplaneta.info.

Links do not open the app yet

The server half of the handshake is in place — code.casinoplaneta.info/.well-known/assetlinks.json is published with the release signing fingerprint. The client half is not: the Android app does not yet declare an autoVerify intent filter for this host, so Android has nothing to match and the link opens in a browser.

Both halves are required. Until the app ships that intent filter, every link below resolves to a web page that explains the destination and offers a download. See implementation status.

Why a separate host

Deep links live on their own hostname, apart from the API and the portal, and that host sets no cookies at all. A link is the one surface strangers hand each other, so keeping it free of session state removes a whole category of cross-site problems: there is no session on code.* to ride, and nothing for a forged link to leak.

Formats

Link	Opens
code.casinoplaneta.info/u/<username>	A profile
code.casinoplaneta.info/join/<token>	An invite to a group or channel
code.casinoplaneta.info/<bot>	A chat with a bot
code.casinoplaneta.info/<bot>?start=<param>	A chat with a bot, sending /start <param>
code.casinoplaneta.info/<bot>?startgroup=<param>	A prompt to add the bot to a group
code.casinoplaneta.info/<bot>?startchannel=<param>&admin=<rights>	A prompt to add the bot to a channel as an administrator
code.casinoplaneta.info/<bot>?startapp=<param>&mode=compact|fullscreen	The bot's main Mini App
code.casinoplaneta.info/<bot>/<appname>?startapp=<param>	A named Mini App
code.casinoplaneta.info/<bot>?attach=&startattach=<param>	A prompt to add the bot to the attachment menu
code.casinoplaneta.info/<bot>?game=<short_name>	A game

The start parameter

start carries 1–64 characters from A-Za-z0-9_-. Nothing else — no spaces, no punctuation, no unencoded UTF-8. Anything outside that set makes the link invalid rather than merely odd.

When someone follows ?start=promo7, your bot receives a normal message:

{
  "message": {
    "chat": { "id": 1337, "type": "private" },
    "text": "/start promo7"
  }
}

So handling it is ordinary text handling — split on the space and read the second token.

It is not a secret

The parameter is visible in the URL, so it is visible to anyone who sees the link: the person who received it, whoever they forward it to, and any chat history it passes through.

That rules out putting anything sensitive in it. It also rules out the common mistake of treating it as proof of anything — a referral code that grants a bonus is a referral code anyone can copy out of a link and reuse.

Use it as a key, not as a claim:

# Wrong: the link asserts a discount, and the bot believes it.
if param == "vip50":
    apply_discount(user, 50)

# Right: the link names a record, and the bot decides.
campaign = db.campaigns.get(param)
if campaign and campaign.is_active and not db.claimed(user, campaign):
    apply_discount(user, campaign.discount)

The difference matters most for referrals, invitations and anything that grants something. Store state on your side, put an opaque key in the link, and check the key against your own records — including whether that user has already used it.

Short and opaque

Sixty-four characters is not much room, and the parameter is often seen by humans. Generate short random ids rather than encoding a payload; base64 of a JSON object will overflow the limit and will not survive the character-set restriction anyway.

Adding a bot to a group

?startgroup= opens a chooser rather than doing anything directly. The person picks the group, sees the rights being requested, and confirms. A link cannot add a bot anywhere by itself — which is why sending one to a stranger achieves nothing on its own.

The parameter arrives with the my_chat_member update that fires when the bot is added, so you can tell which campaign or referral produced a given installation.

Generating links

Nothing to call — build the string:

def start_link(bot: str, param: str) -> str:
    if not re.fullmatch(r"[A-Za-z0-9_-]{1,64}", param):
        raise ValueError("start parameter must be 1-64 chars of A-Za-z0-9_-")
    return f"https://code.casinoplaneta.info/{bot}?start={param}"

Validate before you build, not after. A link with a bad parameter fails at the moment someone tries to use it, which is usually long after you can find out why.