What is an itms-services link?

A special URL scheme that tells iOS to fetch a manifest plist describing the app, then download and install the IPA it points to.

Why does OTA install require HTTPS?

Apple requires the manifest and IPA to be served over valid HTTPS as a security measure — plain HTTP installs silently fail.

Help center

Tapping Install on device on an IPALinked link looks like magic; underneath it's a simple, Apple-defined chain:

The button is an itms-services:// URL pointing at a manifest.plist;
iOS fetches the manifest — it lists the app's bundle ID, version, name and the HTTPS URL of the .ipa;
iOS verifies everything, downloads the IPA and installs it — checking the signature against the device.

Valid HTTPS for both manifest and IPA (IPALinked handles this);
Correct bundle ID in the manifest — IPALinked reads it from your IPA automatically;
A build signed for the device — ad-hoc, enterprise, or development signing.

Fail the third and you'll see “Unable to Install” — the two others are on the hosting side, which IPALinked takes care of.