A save link is how a pass gets into Google Wallet. Where Apple Wallet uses a downloadable PKPass file, Google Wallet uses a URL: the issuer creates a pass object through the Google Wallet API, signs a token (a JWT) describing it, and wraps that token in a link. Opening the link, or tapping an "Add to Google Wallet" button that carries it, saves the pass in one step.
The signature is what makes the link safe. Tokens are signed with the issuer's service account credentials, so Google can verify who created the pass and that it has not been tampered with. Links can reference a pass object that already exists on Google's side, or carry the full object definition in the token itself.
Because a save link is just a URL, it travels anywhere a link does: web pages, emails, SMS, QR codes on receipts or posters, or the end of an enrollment flow. A well-built add to wallet step detects the device and offers the right path, the save link on Android and the PKPass on iPhone, so the member never has to know the difference.
One structural difference from Apple's model is worth knowing: Google Wallet passes live as objects on Google's servers and are updated through the API, rather than as signed files updated via device registrations. A wallet platform hides this difference behind a single pass definition that issues to both.