URL schema
KarSafe accepts two equivalent deeplink forms. Both resolve to the same in-app action registry.
Universal link: https://karsafe.in/app/{action}?key=value&key=value
Custom scheme: karsafe://{action}?key=value&key=value
Action vocabulary
| Action | Route | Parameters |
upload | Upload tagging screen | doc_type, period |
home | Dashboard | — |
docs | All documents list | — |
security | Security settings | — |
export | Export screen | — |
years | Year browser | — |
storage | Storage management | — |
recovery-setup | Recovery phrase setup | — |
encryption-demo | Encryption demo | — |
Unknown actions fall through safely to /home. The app silently rejects malformed actions (validation regex: ^[a-z][a-z0-9\-]{0,30}$).
Upload parameters
period — Tax period in one of two formats.
AY-YYYY-YY Assessment Year (valid up to AY-2025-26)
TY-YYYY-YY Tax Year (valid from TY-2026-27 onward, per Income Tax Act 2025)
If period is omitted or malformed, the app defaults to the current year.
doc_type — The document type slug. Full enumeration below. If doc_type is omitted or unknown, the app opens the upload screen without a pre-selection and lets the user pick manually.
doc_type enumeration
| Group | Slug | Display name |
| Salary | form_16 | Form 16 |
| Salary | form_16a | Form 16A |
| Salary | form_12b | Form 12B |
| Salary | form_12ba | Form 12BA |
| Salary | salary_slip | Salary Slip |
| Income Summary | form_26as | Form 26AS |
| Income Summary | ais | AIS |
| Income Summary | tis | TIS |
| Capital Gains | cg_stmt | Capital Gains Statement |
| Capital Gains | property_docs | Property Documents |
| Interest / FD | bank_stmt | Bank Statement |
| Interest / FD | interest_cert | Interest Certificate |
| Interest / FD | fd_cert | FD Certificate |
| Interest / FD | form_15g_h | Form 15G/H |
| Dividend | dividend_stmt | Dividend Statement |
| Rental | rent_receipt | Rent Receipt |
| Pension | pension_stmt | Pension Statement |
| Tax Filing | itr_ack | ITR Acknowledgement |
| Tax Filing | itr_computation | ITR Computation |
| Tax Filing | it_working | IT Working / Computation |
| Tax Filing | form_10iea | Form 10-IEA |
| Tax Filing | it_notice | IT Notice / Intimation |
| Tax Filing | it_response | IT Response |
| Tax Filing | form_67 | Form 67 (DTAA FTC) |
| Business / Profession | pl_statement | Profit & Loss Statement |
| Business / Profession | balance_sheet | Balance Sheet |
| Business / Profession | invoice | Invoice / Receipt |
| Business / Profession | platform_earnings | Platform Earnings |
| Foreign Tax (US) | w2 | W-2 |
| Foreign Tax (US) | form_1042s | Form 1042-S |
| Foreign Tax (US) | form_1099 | Form 1099 |
| Foreign Tax (UK) | p60 | P60 |
| Foreign Tax (UK) | p45 | P45 |
| Foreign Tax (UK) | sa302 | SA302 |
| Foreign Tax (SG) | ir8a | IR8A |
| Foreign Tax (CA) | t4 | T4 |
| Foreign Tax (AU) | payg_summary | PAYG Summary |
| Foreign Tax (DE) | lohnsteuer | Lohnsteuerbescheinigung |
| Foreign Tax (DE) | jahressteuerbescheinigung | Jahressteuerbescheinigung |
| Foreign Tax (IE) | dirt_cert | DIRT Certificate |
| Foreign Tax (IE) | employment_detail_summary | Employment Detail Summary |
| Foreign Tax (NZ) | ir3 | IR3 |
| Foreign Tax (generic) | foreign_income | Foreign Income |
| Foreign Tax (generic) | foreign_tax_withholding | Foreign Tax Withholding |
| Foreign Tax (generic) | foreign_tax_return | Foreign Tax Return |
| Foreign Tax (generic) | rbi_rate_screenshot | RBI Rate Screenshot |
| Deductions / Other | donation_80g | Donation Receipt (80G) |
| Deductions / Other | insurance_prem | Insurance Premium |
| Deductions / Other | ppf_stmt | PPF Statement |
| Deductions / Other | nps_stmt | NPS Statement |
| Deductions / Other | home_loan | Home Loan Certificate |
| Deductions / Other | other | Other |
Worked examples
https://karsafe.in/app/upload?doc_type=form_16&period=AY-2026-27
https://karsafe.in/app/upload?doc_type=form_1042s&period=AY-2026-27
https://karsafe.in/app/upload?doc_type=p60&period=AY-2026-27
https://karsafe.in/app/upload?doc_type=rent_receipt&period=AY-2026-27
https://karsafe.in/app/upload?doc_type=it_notice&period=AY-2025-26
https://karsafe.in/app/upload?doc_type=itr_ack&period=AY-2025-26
https://karsafe.in/app/upload?doc_type=it_working&period=AY-2026-27
karsafe://upload?doc_type=form_16&period=AY-2026-27
karsafe://upload?doc_type=form_67&period=AY-2026-27
karsafe://home
Security and input handling
All deeplink parameters are sanitised in the app: values are truncated to 100 characters; empty keys are dropped; action names must match ^[a-z][a-z0-9\-]{0,30}$. The app maintains an allowlist of recognised actions; unrecognised actions fall through to the dashboard rather than executing. The upload action sets a pending-import intent and lands on the tagging screen — never auto-uploads without user confirmation.
Encryption guarantees (what to tell users)
When a user taps a Save to KarSafe link: (1) the app unlocks with biometric or PIN if locked; (2) a random 256-bit AES-GCM Document Encryption Key is generated on-device for that file; (3) the file is encrypted with that key; (4) the key itself is wrapped with the user's Key Encryption Key, derived from their vault PIN via Argon2id (m=65536 KiB, t=3, p=4); (5) only the encrypted blob and the wrapped key travel to KarSafe's servers. KarSafe's servers and engineers cannot decrypt user documents — this is enforced by the cryptographic design, not by policy.