REST Clients, Serialization, Authentication and Token Refresh, Caching, Errors, Uploads, and Testing

Read before you buy: the PDF here is a free sample — the first 20 pages of the 458-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Go beyond "add Retrofit and call the API" and build a network layer you can ship and defend in a code review.

Getting a first request working on Android takes a dozen lines. Getting networking right takes much more: JSON that keeps decoding when the server adds fields, errors that make sense to users, tokens that refresh exactly once when ten requests fail at the same moment, caching that saves data without showing stale information, uploads that report progress, retries that do not turn an outage into a storm, live updates, and tests you can actually trust.

This book teaches all of it through one realistic app. Every chapter adds a real capability, explains the HTTP behavior underneath it, and shows real traffic and real test output, so you understand why the code works and how to debug it when it does not.

What's inside

• HTTP for app developers: methods, idempotency, status codes, headers, and REST resource design
• OkHttp in depth: one shared client, application and network interceptors, logging with redaction, timeouts, connection reuse, event listeners, and the retries OkHttp performs on its own
• JSON with kotlinx.serialization: DTOs separate from domain models, defaults, dates, unknown keys, and unknown enum values
• Retrofit 3 with the official kotlinx.serialization converter: service interfaces, suspend functions, query encoding, and multipart
• A clean API layer: mappers, repositories, Hilt wiring, and a debug build that runs against an in-process fake backend
• Errors as values: a NetworkResult type for HTTP errors, error bodies, network failures, and bad JSON, with friendly user messages
• The Ktor client as a Kotlin-first alternative: engines, plugins, content negotiation, and the same API side by side with Retrofit
• Coroutines for networking: main-safety, cancellation, parallel calls, and search with Flow
• Authentication: login, bearer tokens, session state, OkHttp's Authenticator, single-flight refresh with rotating refresh tokens, and Ktor's bearer Auth plugin
• Transport security: HTTPS, the Network Security Configuration, and certificate pinning with backup pins
• Performance: HTTP caching with Cache-Control and ETags, Paging 3, multipart journal photos with progress, batched uploads, streaming and resumable downloads, and Coil 3 on the shared OkHttp client
• Resilience and real-time: connectivity awareness, retries with exponential backoff, jitter, and Retry-After, WebSockets with OkHttp and Ktor, and Server-Sent Events
• Testing and tooling: MockWebServer, Ktor MockEngine, fault injection, virtual time, GraphQL over plain HTTP, and debugging without leaking secrets

One running example, start to finish. You build the network layer of Waypoint, a hiking trip planner by the fictional studio Northbeam Labs, against a fictional REST API that is specified down to every endpoint, header, and JSON field. A fake Waypoint server runs inside ordinary JVM unit tests: it answers with deterministic data (a fixed clock, predictable tokens and IDs), supports sign-in with rotating refresh tokens, uploads, ranged downloads, Server-Sent Events, a WebSocket, and a small GraphQL endpoint, and injects faults such as 503s, timeouts, dropped connections, and broken JSON. Every networking example runs with a plain test command; no emulator, device, or real server is required.

Current and honest. The code targets Kotlin 2.4, OkHttp 5, Retrofit 3, kotlinx.serialization 1.11, Ktor 3, Coil 3, and recent Android tooling, with versions stated as "at the time of writing" and draft standards labeled as drafts. The outputs in the book come from running the code, and the book contains no invented benchmarks or statistics. Every chapter includes Kotlin code, real HTTP exchanges and test results, Tips, Notes, Warnings, exercises, and Key Takeaways, and the appendices give you a cheat sheet, the full API reference with reusable code templates, a production checklist, and a glossary.

Format: PDF, 458 pages (A4), linked table of contents and bookmarks. English. First Edition, 2026. Published by thenexbooks. Includes the Waypoint starter project (Gradle, Kotlin) with the fake Waypoint server and its tests. Requires a computer with JDK 21 and the Android SDK (Android Studio recommended) to build the code. This book is independent and is not affiliated with, sponsored by, or endorsed by Google, JetBrains, Square, or any other company or open-source project mentioned.

Table of Contents

Part I — HTTP and OkHttp Foundations

• Ch 1 · How Android Apps Talk to Servers: HTTP, REST, and the Waypoint API
• Ch 2 · OkHttp Essentials: Clients, Requests, Responses, and the Fake Waypoint Server
• Ch 3 · Interceptors: Default Headers, Logging, and the Request Pipeline
• Ch 4 · Configuring OkHttp: Timeouts, Connection Pools, Dispatchers, and Event Listeners
• Ch 5 · JSON with kotlinx.serialization: DTOs, Defaults, Dates, and Unknown Values

Part II — Typed API Clients with Retrofit and Ktor

• Ch 6 · Retrofit 3 Fundamentals: Service Interfaces, Converters, and Suspend Functions
• Ch 7 · Designing the Waypoint API Layer: DTOs, Mappers, Repositories, and Dependency Injection
• Ch 8 · Errors as Values: HTTP Errors, Error Bodies, and NetworkResult
• Ch 9 · The Ktor Client: Engines, Plugins, and the Same API in Ktor
• Ch 10 · Networking with Coroutines: Dispatchers, Cancellation, Parallel Calls, and Flows

Part III — Authentication and Security

• Ch 11 · Authentication Fundamentals: Login, Bearer Tokens, and Session State
• Ch 12 · Refreshing Tokens with OkHttp's Authenticator
• Ch 13 · Concurrency-Safe Token Refresh: Single-Flight Renewal and Rotating Refresh Tokens
• Ch 14 · Authentication in Ktor: The Auth Plugin and Bearer Refresh
• Ch 15 · Transport Security: HTTPS, Network Security Configuration, and Certificate Pinning

Part IV — Data Transfer and Performance

• Ch 16 · HTTP Caching with OkHttp: Cache-Control, ETags, and Conditional Requests
• Ch 17 · Pagination: Page-Based APIs, Paging 3, and the Trails List
• Ch 18 · Uploads: Multipart Journal Photos, Progress, and Batched Track Points
• Ch 19 · Downloads and Streaming Bodies: GPX Tracks, Progress, and Resumable Transfers
• Ch 20 · Loading Images with Coil 3: Sharing OkHttp, Caching, and Compose

Part V — Resilience and Real-Time

• Ch 21 · Connectivity Awareness: Network Callbacks, Metered Networks, and Offline UX
• Ch 22 · Retries and Backoff: Idempotency, Retry-After, and Exponential Backoff with Jitter
• Ch 23 · Live Trips with WebSockets: OkHttp and Ktor
• Ch 24 · Server-Sent Events and Streaming Updates

Part VI — Testing, Tooling, and Production

• Ch 25 · Testing the Network Layer: MockWebServer, Ktor MockEngine, and the Fake Waypoint Server
• Ch 26 · GraphQL in Brief: Queries over Plain HTTP and When to Adopt a Client Library
• Ch 27 · Debugging and Observability: Logs, Event Listeners, Proxies, and Privacy
• Ch 28 · Case Study: Shipping Waypoint's Network Layer — Architecture Review and Production Checklist

Appendices
A · Networking Cheat Sheet
B · Waypoint API Reference and Code Templates
C · Production Networking Checklist
D · Glossary

Book details