Sign in Get started

Free course · 20 lessons · Intermediate

Mobile API Best Practices

Design backends for iOS and Android: screen-shaped responses, payload and battery efficiency, offline-first and delta sync, conflict resolution, push, versioning with old app versions, forced upgrades, feature flags, PKCE and token rotation, attestation, flaky networks and media.

Start the course

1. Designing APIs for Mobile Clients

Why mobile is different and how to shape APIs for it.

  1. Why Mobile Is Different — Old clients live forever, networks are flaky and every byte costs battery.
  2. Screen-Shaped Responses & Aggregation — Avoid waterfalls of requests by aggregating what a screen needs.
  3. Payload, Compression & Battery Efficiency — Fewer bytes, fewer wake-ups: compression, pagination, image sizing and batching.
  4. Lists, Pagination & Infinite Scroll — Cursor pagination, stable ordering and refreshing lists without duplicates.
  5. Errors Mobile Clients Can Act On — Stable machine-readable codes, localized messages and retry hints.

2. Offline-First & Sync

Local-first storage, delta sync and conflict resolution.

  1. Offline-First Architecture — Local database as the source of truth for the UI, with background sync.
  2. Delta Sync Protocols — Sync only what changed: change tokens, tombstones and resync.
  3. Conflict Resolution — Last-writer-wins, field merges, server rules and CRDTs.
  4. Background Sync, Push & Silent Notifications — Keeping data fresh when the app isn't open.

3. Versioning, Upgrades & Remote Control

Evolve the API without breaking installed apps.

  1. Versioning With Old Clients in the Wild — Additive changes, tolerant readers and version telemetry.
  2. Minimum Versions & Forced Upgrades — Soft and hard upgrade prompts driven from the server.
  3. Feature Flags & Remote Config — Decouple release from deploy for binaries you can't roll back.
  4. GraphQL & Persisted Operations for Mobile — Client-selected shapes with safe, cacheable, versioned operations.

4. Mobile Auth, Security & Flaky Networks

Tokens, attestation, retries and media.

  1. Mobile Authentication: OAuth, PKCE & Refresh Rotation — Authorization code + PKCE via the system browser; rotating refresh tokens.
  2. Device Registry, Sessions & Remote Logout — Track devices, bind push tokens and sign out lost phones.
  3. App Attestation & API Abuse From Fake Clients — App Attest, Play Integrity and what they can (not) prove.
  4. Flaky Networks: Timeouts, Retries & Idempotency — Reliable requests over unreliable links.
  5. Media Uploads & Delivery — Direct-to-storage uploads, resumable transfers and image CDNs.
  6. Observability for Mobile APIs — Measure what users experience: per-version metrics, client traces and crash correlation.

5. Capstone

Design the backend for an offline-capable field-service app.

  1. Capstone: Offline Field-Service App — Design the API and sync model for technicians working without connectivity.