Networking with Retrofit

Talking to servers

Most apps get their data from a server through a web API: a set of URLs that return data, usually as JSON. For example, GET https://api.example.com/products/42 might return the details of product 42. HTTP is the protocol used: GET reads data, POST creates, PUT/PATCH update, DELETE removes. Retrofit, an open-source library by Square, is the most widely used way to call such APIs on Android.

Step 1: the permission

<uses-permission android:name="android.permission.INTERNET" />

Step 2: describe the API as an interface

@Serializable
data class Product(val id: Int, val name: String, val price: Int)

@Serializable
data class NewReview(val productId: Int, val stars: Int, val text: String)

interface ShopApi {
    @GET("products")
    suspend fun products(@Query("category") category: String): List<Product>   // /products?category=...

    @GET("products/{id}")
    suspend fun product(@Path("id") id: Int): Product                          // /products/42

    @POST("reviews")
    suspend fun addReview(@Body review: NewReview): Response<Unit>             // sends JSON body
}

Response<Unit> in addReview gives you the full HTTP response, including the status code, instead of just the body. Use it when the server returns no body or when you need to check the code yourself.

Step 3: build Retrofit

val json = Json { ignoreUnknownKeys = true }

val retrofit = Retrofit.Builder()
    .baseUrl("https://api.example.com/")              // must end with "/"
    .addConverterFactory(json.asConverterFactory("application/json".toMediaType()))
    .build()

val api: ShopApi = retrofit.create(ShopApi::class.java)

Step 4: call it from a repository

class ProductRepository(private val api: ShopApi) {
    suspend fun productsIn(category: String): List<Product> = api.products(category)
}

// In a ViewModel:
// viewModelScope.launch { val list = repository.productsIn("kurtas") }

HTTPS and security

Since Android 9 (API 28), apps that target it block plain HTTP (cleartext) traffic by default; use HTTPS URLs. Never put secret API keys in the app: anyone can unpack an APK and read them. Keep secrets on your server and let the app talk to your server.

Seeing what happens: logging

OkHttp, the HTTP engine under Retrofit, has a logging interceptor that prints every request and response in Logcat. Add it only to debug builds, because logs can contain tokens and personal data.

Common mistakes

• Forgetting the INTERNET permission: requests fail with a SecurityException or "permission denied".
• A base URL without the trailing slash: Retrofit throws "baseUrl must end in /".
• Using http:// URLs: blocked as cleartext on modern Android.
• Calling the API from a composable. Go through a repository and ViewModel.