The answer in four sentences
Almost everyone ships the plain pattern: the account is ready, here is the email you paid with, download the app, sign in with it. BetterMe, Flo, Fastic, Yazio, Zing, Rise, Second Nature, Simple, Nibble, BitePal and Lose It all do exactly this, most with a password set in the funnel, Simple with a six-digit email code.
The three biggest funnels add an auto-login deep link on top, never instead. Noom, Headway and Liven run an AppsFlyer OneLink carrying an auth token, delivered by SMS, QR and email, and each keeps the manual path beside it because the deferred link misses.
iOS gives you one deterministic move: a tappable "Open the app" button whose link is on a different associated subdomain. Universal Links never fire on Stripe's redirect or any JavaScript hop, fingerprinting is banned by Apple regardless of ATT, and RevenueCat cannot mint a redemption link for your own Stripe Checkout.
App Review accepts sign-in and rejects codes. Every non-reader app that unlocked web-bought content without IAP was rejected; every typed code field drew 3.1.1; email or password sign-in passed. FiftyStrong has the IAP and the email sign-in already. What is missing is only the handoff itself.
Sign in with the purchase email
The floor. Universally shipped, reviewer-accepted, and the thing the support corpus says breaks when the email doesn't match.
One tap, never zero
After Stripe returns her to your page, the only way into the installed app is a button she taps, on a cross-subdomain link, carrying a single-use grant.
Nobody measures the leak
No source publishes a purchase-to-sign-in rate. Vendors claim 90–95% install; the identity match is where FunnelFox says money leaks.
What the category actually ships
Ranked by how many named apps run each pattern, from their own support articles and from success-page copy pulled out of their shipped JavaScript on 22 September 2026.
| Pattern | Apps | What she sees |
|---|---|---|
| 1. Account created in the funnel, same email + password in the app | BetterMe, Flo, Fastic, Yazio, Zing, Rise, Nibble, BitePal, Second Nature, Lose It, Headway (manual path), Hims, Promova, Blinkist | Download page shows her email (BetterMe adds a copy button) and "the password you just created". App: "I already have an account". |
| 2. Deferred deep link with auto-login, manual path beside it | Noom, Headway, Liven (AppsFlyer OneLink); Cal AI (own link with authCode + email) | SMS-me-the-link, QR, or emailed button. "You'll continue to the App Store, then be automatically logged in." Fallback: Noom's UPID code, Headway's password, Liven's emailed credentials. |
| 3. Passwordless: email, then a six-digit code or magic link | Simple (default); BetterMe "Fast Login" (recovery only); Headway 4-digit code at sign-up | "Enter your email and tap Let's go. A six-digit code will be sent… or click the Confirm Email button." |
| 4. Credential or activation artefact emailed, redeemed in-app | Liven (password emailed), Mindvalley (temp password), Coursiv (registration link), Noom (UPID), Fabulous (magic link that redirects to the store) | "Log in using the credentials we sent you via email titled 'Liven app login instructions'." |
| 5. Social-provider continuity | Second Nature, Noom, Flo (Google), Fabulous, FunnelFox OAuth | Works only with the same provider on both ends. Private Relay is the trap every help centre documents. |
| 6. Desktop-to-phone hop | QR: Noom, Flo, Liven, Second Nature, Future, Ladder. SMS: Noom, Rise. "Open the email on your phone": Noom | Near-universal on any page that is more than a store badge. |
| 7. Not observed anywhere | — | Pasteboard tokens, App Clips, passkeys or Password AutoFill via webcredentials, Smart App Banner arguments. |
Verbatim, from the pages themselves
"Welcome to BetterMe!" · "Just one more step!" · "It's time to download the app:" · "Enter your email and the password you just created to start your weight loss journey." · "The email was copied!" · "Having Trouble Logging In?" · "DOWNLOAD BETTERME"betterme-fasting.com/download, Next.js i18n bundle
"Your Flo membership is now active" · "1. Download the Flo app." · "2. Log in to your account." · "Or, scan the QR code below." · "Next, you'll be asked to log in. Make sure to use the same email and password you used when you created your account on our website."app.flo.health/download
"You're all set! Now let's start your program in the app..." · "If you already have the app installed, just open it to begin! If not, download the app with either of these 2 options:" · "Option A: Open the link from the text message." · "Option B: Scan the QR code below with your phone's camera." · "Enter a valid mobile phone number, and we'll send you a text message with a direct link to get into the Noom app with your account." · "*Your phone number will be used exclusively to send you the link and not for marketing purposes." · "Prefer not to enter your phone number? Just open the email from us on your phone." · "If you have not installed the app yet, you'll continue to the App Store, then be automatically logged in."noom.com/payment/success, buyflow bundle
"Scan this QR code from your phone to download Liven, and you will be logged in to your account automatically" · "Log in manually" · "Log into Liven App using your credentials above"quiz.theliven.com bundle; email "Liven app login instructions"
headway.onelink.me/zG5O?pid=WO Payment success&c=WO Auto Login&deep_link_value=headway://auth/wo/… · email field label "It will be your Headway login"makeheadway.com onboarding RSC payload
"Open the app and tap Sign in: Enter your email and tap Let's go: A six-digit code will be sent to your email… Alternatively, you can click the 'Confirm Email' Button present in the email sent to you. This will automatically verify your email and sign you in."help.simple.life, how to sign in
Every good success page does three things
The template that falls out of the recovered copy. Yazio adds a fourth line nobody else has, for sync lag: "close the app completely and open it again."
1. Name the identity
"Enter your email and the password you just created." Show the email, verbatim, with a copy button. This is the sentence that prevents the number-one support ticket.
2. Phone-scoped route to the store
QR for anyone on a Mac, SMS-me-the-link, or a deep-link button. Noom's disclaimer is the compliance shape for phone capture.
3. Say what happens on first open
"Next, you'll be asked to log in." or "You'll continue to the App Store, then be automatically logged in." Expectation-setting is what stops her tapping Restore Purchases.
Between "Pay" and this page, BetterMe, Coursiv, Noom and Liven insert one-click upsell ladders (BetterMe: coaching plus a fitness band at $29.99 for four weeks, then a $19.99 workout bundle). They delay the handoff and are out of scope here.
What iOS lets you do in 2026
Each mechanism, the verdict, and the failure mode that decides it.
| Mechanism | Verdict | Why |
|---|---|---|
| Universal Link as Stripe's success URL (303 redirect) | does not open the app | Apple DTS 2025–26: "Universal Links do not support HTTP 403 or JavaScript URL redirection… Please do not use any redirect at all." Redirect flows that worked on iOS 17 broke from 18.1. Stripe's own doc warns to keep a fallback page. |
| Tappable link on a different associated subdomain | deterministic when installed | TN3155: same-domain navigation stays in Safari; "use a different subdomain… choosing to sign in." A user tap on a cross-host link is handed to the app. Not installed: that subdomain serves the App Store link. |
| Deferred deep link (Branch, AppsFlyer, Adjust) | 60–90%, needs a fallback | Guaranteed only via pasteboard (paste prompt) or IDFA with ATT. Branch: auto-login only when +match_guaranteed, "usually false on install events". Apple's FAQ requires ATT for cross-company deferred tools. |
| Probabilistic / device-signal matching (web2wave-style) | banned | Apple: "you may not derive data from a device for the purpose of uniquely identifying it… regardless of whether a user gives your app permission to track." Resolves the Airbridge vs Branch contradiction in Airbridge's favour. |
| Custom URL scheme carrying a token | hijackable | A sibling app can register the same scheme (Shopify H1 #855618, CVE-2026-26123). RevenueCat and Adjust use custom schemes; Qonversion uses Universal Links. |
| Magic link by email | with a code in the same email | Apple Mail opens the app for applinks domains; Gmail's iOS webview does not. Mail-security scanners consume GET tokens, so consume only on the app's POST. Never inside an ESP click-tracking wrapper. |
| Six-digit email code | the accepted floor | iOS 17 autofills codes from Apple Mail, iOS 26 from third-party mail apps. Fails only on the wrong email. |
Password AutoFill / passkey via webcredentials | works on first launch, unused by the category | A Safari-saved credential is offered in the app's sign-in form after Face ID; an autofilled password sign-in triggers the automatic passkey upgrade. No adoption data for a 50+ audience. |
| Sign in with Apple continuity | relay email mismatch | Same sub only with a grouped Services ID; the relay address never matches the paid email; Blinkist, Surfshark, Promova, DAZN all document it. ASO.dev lost a third of users to new identifiers in 2025. |
| Smart App Banner argument · App Clips · pasteboard | not a handoff | Banner argument doesn't survive install; App Clips need the identity created inside the Clip; pasteboard reads prompt since iOS 16. |
What the vendors prescribe
| Vendor | Identity link | Delivery and expiry | Gotcha |
|---|---|---|---|
| RevenueCat | App User ID in the purchase-link path, or anonymous + Redemption Link (SDK 5.14.1+) | Hosted success page, purchase email, ?redeem_url=. Custom scheme, one use, 60 minutes; fails on desktop or without the app. | Not available for your own Stripe Checkout. Own checkout needs App User ID in both Checkout Session and Subscription metadata, or a later POST /receipts alias. Bug #6965 (entitlement lands on the anonymous ID) closed unresolved. |
| Adapty / FunnelFox | customer_user_id, defaults to the checkout email | "Download app" button with an optional deferred deep link (Adapty UA, AppsFlyer, Adjust) | Verbatim ranking: "Email + magic link: most reliable with excellent user experience… Deferred deep link: most seamless, but less reliable and requires a backup method." "Installing the app from a link in the funnel does not identify the buyer." |
| Superwall | Identity before checkout | Redeem mode (download, then tap the redemption link) or redirect mode | Web entitlements refresh every 24 hours; a "manage" page to re-find the link. |
| Qonversion | Grant-first; the device that redeems gets the entitlement | Universal Link, 30 days; the desktop "Open in app" page does not consume the token | Uniform response on re-issue "so the endpoint can't be used to probe which emails have purchases." The security-literature-approved shape. |
| Stripe | client_reference_id, prefilled_email | "Set a universal link as your success URL" plus a fallback page | Prefilled email is locked on hosted Checkout; the wallet email is not exposed separately. Auth is out of scope. |
| web2wave | user_id + email on a deeplink page | Desktop QR; not installed → store; installed → custom scheme | Without an MMP: "Install the app via the link and then REVISIT the link." Its no-MMP device-signal match is what Apple bans. |
App Review, in the inbound direction
Nothing about the web purchase itself is Apple's business. What reviewers judge is what the app shows a web subscriber, and how it unlocks.
- 3.1.3(b) is the cover, and it requires IAP for the same items. "Apps that operate across multiple platforms may allow users to access… subscriptions… they have acquired… on your web site, provided those items are also available as in-app purchases within the app." A May 2026 rejection spelled out App Review's reading: without IAP, "Pro features visible to paid web users on iOS" is plain 3.1.1. FiftyStrong sells the same plans as IAP, so the cover applies.
- Code-entry fields are rejected every time. Product keys (rejected 9 to 11 times, 2022–23), promo codes validated by your own backend (2023). Apple phone support: you "can use a username/password to unlock app features, even if the password is actually the license key." Sign-in is the accepted shape; a typed activation code is not.
- Rejections cited here: a workout-and-diet app whose reviewer found the pricing page by visiting the website (2024); a hardware tracker's data plans (2025); a no-code app with Stripe-only unlock (2026); Cal AI removed for embedding Stripe inside the app (April 2026).
- Outside the US the app may not "encourage users to use a purchasing method other than in-app purchase". A neutral "Already have a plan? Sign in" is fine; a link to the site, a pricing mention, even a support mailto that talks about billing has counted as steering. Inside the US, links and CTAs are allowed since May 2025, with a cost-based commission pending after the December 2025 Ninth Circuit ruling.
- Keep Restore Purchases (missing it is a guaranteed rejection) and beside it a neutral web sign-in entry. Approved manage-subscription wording, from the Claude iOS app: "This subscription cannot be cancelled or changed within this app because it was purchased on another platform. To manage your subscription, please log in to your account where you made the purchase."
- No login wall before non-account content (5.1.1(v)), and account deletion in-app.
- Review notes that pass (Vermillion's template): "Users receive identical access regardless of purchase method", the flow as an arrow chain, and no pricing comparison shown in the app.
Numbers, and their absence
| Metric | Value | Source | Trust |
|---|---|---|---|
| Web purchase → app install | 90–95%, "top performers 98%+" | FunnelFox CEO (2024), Adapty blog (2026); same lineage | Vendor claim, no methodology |
| Purchase → download, threshold | "Best-in-class 90%+. Below 85%, fix your post-purchase flow before you spend another dollar on ads" | FunnelFox, 2026 | Benchmark, prescriptive |
| Purchase → sign-in / identity match | Not published anywhere | All 12 agents | The gap this design must measure itself |
| Deferred deep link match, iOS | 60–90% | Airbridge, Linkrunner, Tolinku, HN builders | Range agreed by several vendors |
| Web paywall vs IAP paywall (app-to-web direction) | IAP 27–30% vs web 17–19% initial conversion | RevenueCat's Dipsea A/B, 2025 | Real test, opposite direction |
| Web share of revenue | Flo ~50%, BetterMe ~half, Liven ~90% | Company statements | Credible |
| Who web2app works for | "$50+ ARPU… a 35+ audience who will type a card number into a browser" | One operator on X, 2026-08 | Anecdote, consistent with Headway's "web subscribers are older" |
| FiftyStrong's own Stripe data | 10 completed live sessions; 7 prefilled, all 7 unchanged; 0 relay emails | Checked 2026-09-22 | Small sample; the wallet is not the leak |
The design space for FiftyStrong
Baseline: the quiz collects name and email; Stripe Checkout is prefilled with it; fulfilment creates the person with no password, and the personal link is the login; the welcome page and email never mention the app. The app signs in by email code, or Apple / Google / Facebook once linked. Two structural facts shape everything: a passwordless email identity already exists on both sides, and the personal link is a long-lived bearer credential that must never ride in an app-opening link.
A · Instruct, name the identity, prefill foundation
Welcome page and email gain "Get the iOS app" (App Store link, QR), the email she paid with (copy button), "we'll email you a six-digit code", and what happens next. App first screen adds "Already have a plan? Sign in", email prefilled when known, code autofill. Backend stores both the quiz email and the checkout email and matches either; never creates a second person on a non-matching re-auth.
Near-zero cost, zero review exposure. This is what BetterMe, Flo, Simple and Zing ship. She still types an email and reads a code.
B′ · Tappable "Open the app" button on a dedicated subdomain, carrying a one-use grant deterministic when installed
Mint a grant at fulfilment: random, single-use, bound to the person, revocable, never derived from the personal link. Put it in a link on app.fiftystrong.app (its own AASA with applinks and webcredentials). The success page and the email show one big button. Installed: the tap opens the app, which exchanges the grant on POST for a session. Not installed: the subdomain page shows the App Store button and "then come back and tap Open the app". Because the grant is consumed only in-app, the emailed button keeps working after install and scanners cannot burn it.
Expiry: days, not RevenueCat's 60 minutes (the documented Opal failure), single-use, revoked on first successful sign-in by any method, re-minted on every welcome-page visit. One subdomain, one table, one route, one page. No SDK, no vendor, no prompt. Still one tap after a fresh install, so the app's first screen must also offer A.
E · webcredentials + "Save a passkey" on the welcome page optional layer
A Safari-saved credential is offered in the app's sign-in form on first launch after Face ID, and an autofilled password sign-in triggers iOS's automatic passkey upgrade. Deterministic and Apple-native, but it asks her to do one more thing after she has what she came for, and no data exists on passkey uptake for women 50+. Ship as optional, measure.
F · Sign in with Apple on the web, grouped Services ID complement
Same identity in the app, relay-proof for Apple Pay buyers. Never as the only anchor: Apple returned new identifiers for a third of one app's users in 2025.
D · MMP deferred deep link, as Noom, Headway and Liven later A/B at most
The only mechanism that lands her signed in on first launch with zero typing. Against it: Apple requires ATT for cross-company deferred tools and bans fingerprinting; 60–90% match with the miss landing on a paywall; a paste or ATT prompt on first launch for a 50+ audience; monthly cost and "a week or two" of setup; Headway's own link is a hijackable custom scheme. Noom's UPID and Headway's password are the admission that it misses.
C · Vendor redemption link (RevenueCat, Superwall, Qonversion) ruled out for this stack
RevenueCat cannot mint one for FiftyStrong's own Stripe Checkout; it would mean moving checkout onto RC Web Billing or Funnels. Even then: custom scheme, 60 minutes, desktop failure, an unresolved aliasing bug. Keep RC as the ledger: put a stable App User ID in the Checkout Session and Subscription metadata so the web subscription shows on the same RC customer the app uses.
G · Typed activation code, Noom-style dropped
Code-entry fields drew 3.1.1 rejections in every forum case found. Noom's survival is not a precedent a solo founder can lean on. The manual last rung is "sign in with your email", which is the accepted shape.
What A + B′ would look like
Using the recovered competitor copy as reference. Copy is illustrative; the structure is the point.
You're all set, Margaret.
Your plan is ready in the FiftyStrong app.
Open the appDon't have it yet? Get it on the App Store, then come back and tap Open the app.
In the app, sign in with
We'll email you a six-digit code. No password to remember.
Your personal link is below, as before. Having trouble? Write to hello@fiftystrong.app.
Your FiftyStrong plan is ready
Open the appDon't have it yet? Download FiftyStrong on the App Store, then tap the button above again.
Or sign in with margaret@example.com and we'll send you a code.
The button carries a single-use grant that only the app can spend. Your personal web link is separate.
Sign-in: email (QuickType offers a saved credential if E is on), then the six-digit code with autofill. Providers only if linked, else "use your email". Entitlement is checked before any StoreKit paywall. Restore Purchases stays, with "Subscribed on the web? Sign in with your email" beside it.
Rules the failure corpus imposes
- Store both emails; match the code on either; never mint a second person on a non-matching re-auth (the Rise, Replika and Dropbox orphaning cases).
- Check entitlement on first open before the paywall; a web subscriber never sees the paywall first (Fabulous's duplicate-subscription warning).
- Detect the Meta and TikTok in-app browsers and say "open in Safari" before the App Store link; Meta stopped honouring App Store redirects in August 2026.
- If the grant is spent or expired, the app shows one uniform message: "That link has been used. Sign in with the email you paid with." No hint about which emails exist.
- Instrument the chain: purchase → welcome view → button tap → store hop → first open → grant exchange or code sign-in → entitlement recognised. It will be the first measured number in the category.
- Review notes: "Users receive identical access regardless of purchase method" and the arrow chain Pay → welcome → Open the app / App Store → sign in with email → plan unlocked.
Open questions
- Screen order after Noom's or Headway's auto-login tap, and whether they prompt ATT or use the pasteboard to make it deterministic. Strings are recovered; the sequence is not. Closing it means transcribing three walkthrough videos (ElevenLabs minutes) or buying one subscription per competitor. Both need your approval to spend.
- Does a Universal Link tap inside the Instagram or TikTok in-app browser open the app after Meta's August 2026 change? Most FiftyStrong buyers arrive that way. Untested; decides whether the "open in Safari" interstitial goes before or after the button.
- Any 2025–26 approval on record for a fitness app with IAP recognising web subscribers by sign-in. The closest forum case (a sign-in-only workout app, 2024) got only "book a Meet with Apple consultation" from Apple.
- Passkey uptake for women 50+. No data exists; only our own measurement will answer it.
- Four turn-one quotes are still agent-reported (BetterMe Fast Login, Headway, Yazio, Mindvalley help articles). The Zendesk JSON route can fetch them verbatim at no cost.
Sources
A selection. The full grouped list, ~150 URLs across both turns, is in the run directory's synthesis-t2.md.
Apple
- App Store Review Guidelines 3.1.1, 3.1.3(b), 5.1.1(v) — developer.apple.com/app-store/review/guidelines
- User privacy and data use FAQ (fingerprinting, deferred deep linking) — developer.apple.com/app-store/user-privacy-and-data-use
- TN3155 Debugging Universal Links — developer.apple.com/documentation/technotes/tn3155-debugging-universal-links
- Forums 780496 (Universal Links and redirects, DTS), 825551 (3.1.3(b) requires IAP), 713044 and 740710 (product keys), 736622 (promo codes), 746691 (workout plans), 757870 (sign-in-only workout app), 714440 (passkeys across app and web)
- WWDC24 10125 and WWDC25 279 (automatic passkey upgrades); Platform Security guide: Password AutoFill
Competitors
- noom.com/payment/success (buyflow bundle); Noom support: UPID (2025-10)
- betterme-fasting.com/download (i18n); bettermesupport.zendesk.com 360019814357, 7978262268829
- app.flo.health/download; help.flo.health 4406832317076
- makeheadway.com onboarding payload; headway.zendesk.com 4408099517714
- quiz.theliven.com bundle; support.theliven.com 31227579392018
- help.simple.life 9887863, 9887888; help.thefabulous.co 101000532053; zingcoach.zendesk.com 20926975580956; yazio.com/en/app/onboarding/success; secondnature.io/us/download-app; risescience.com/download-rise; support.blinkist.com 218550657; calai.app/manage-subscription
Vendors
- revenuecat.com/docs/web/redemption-links; /docs/web/integrations/stripe; /guides/web-to-app-funnels/handoff; community #6965; purchases-ios #5590
- adapty.io/docs/funnelfox; funnelfox.com/docs/integrations/authentication/sign-in-methods; blog.funnelfox.com/hidden-post-purchase-metrics
- superwall.com/docs web checkout; documentation.qonversion.io/docs/web-funnel-redemption; docs.stripe.com/mobile/digital-goods; docs.web2wave.com
- help.branch.io methodology overview and NativeLink; dev.appsflyer.com UDL; airbridge.io deferred-deeplink accuracy; tolinku.com guides
- resend.com/docs/dashboard/domains/tracking; resend-openapi spec
Discourse
- Reddit: r/assholedesign Opal thread; r/Appstore deferred-link drop; r/FlutterDev Stripe subscriptions; r/iOSProgramming Claude-app wording; r/DropboxOfficial; r/surfshark
- Hacker News: 49793476, 36900782, 43905697, 47542761, 46245398, 43680597
- X: Zabolotin reference stack; Jake Mor's Apple meeting notes (2026-06); Eiting on Dipsea; Desmond's web2app storytime; Witzel on Duolingo's flow
- Vermillion App Review notes template; Stingrai deep-link account takeover; EuroUSEC 2025 older adults and passkeys; FIDO State of Passkeys 2026