Networking and APIs Interview Questions for Android App Development
25 Networking and APIs questions with answers for android app development roles — 4 easy, 15 medium, 6 hard.
About Networking and APIs
Android apps talk to backends through REST, GraphQL, WebSockets and push notifications. This topic covers Retrofit, OkHttp interceptors, token refresh, JSON serialization, error handling, certificate pinning, image loading, FCM and designing for slow networks. Expect scenario questions about failures, retries and keeping user data safe.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is Retrofit and how does it work with coroutines?
Retrofit is a type-safe HTTP client that turns an annotated Kotlin interface into API calls. You declare methods with @GET, @POST, @Path, @Query and @Body, and Retrofit generates the implementation using OkHttp underneath. Marking methods as suspend makes them main-safe and cancellable, returning the parsed body directly or Response<T> when you need status codes and headers. A converter like kotlinx.serialization or Moshi parses JSON.
02
Write a Retrofit interface for listing products with paging and fetching one product.
Use ConnectivityManager with registerDefaultNetworkCallback and NetworkCapabilities to check NET_CAPABILITY_INTERNET and VALIDATED, and expose it as a Flow with callbackFlow. NetworkInfo and the CONNECTIVITY_ACTION broadcast are deprecated. Remember that being connected does not guarantee a working server, so still handle request failures. Use the status to show an offline banner and pause retries, not to block every request.
04
How do you handle a situation where you are blocked by another team's API not being ready?
I agree on the API contract early, with sample JSON, and build against a fake or mock server so my UI and logic are ready. I keep the repository interface stable, so switching to the real API is a small change. I communicate status in standups and raise risks to my lead early if the dependency threatens the deadline, suggesting options like releasing behind a feature flag.
05
What are OkHttp interceptors and give common uses.
Interceptors observe or modify requests and responses in the OkHttp chain. Application interceptors run once per call and are used for adding auth headers, common query parameters or logging with HttpLoggingInterceptor. Network interceptors run for each network request including redirects and see the actual network bytes, useful for cache headers. Never log full bodies or tokens in release builds, because logs can leak sensitive data.
06
Write an OkHttp interceptor that adds a bearer token to every request.
kotlinx.serialization is Kotlin-first, uses a compiler plugin with no reflection, respects default values and nullability, and works in Kotlin Multiplatform. Moshi supports Kotlin through codegen and is also reliable. Gson uses reflection, ignores Kotlin nullability and default values, and can put null into non-null fields, causing crashes later; it is in maintenance mode. For new Android projects, kotlinx.serialization is the common choice.
08
How do you model API results and errors cleanly for the UI?
Map transport-level outcomes into a sealed result type in the data layer, for example Success(data), HttpError(code, message) and NetworkError. Catch IOException for connectivity, HttpException for non-2xx codes, and serialization exceptions for bad payloads, and never catch CancellationException. The ViewModel converts these into user-friendly UiState messages. Keep DTOs separate from domain models so API changes do not ripple through the UI.
09
Users on slow 2G and 3G networks in small towns report the app keeps failing. How do you improve it?
Set reasonable connect and read timeouts, retry idempotent requests with exponential backoff, and cache responses so screens show something offline. Reduce payload size with gzip, pagination and fields filtering, and load images in smaller sizes with placeholders. Show clear offline and retry states instead of generic errors. Test with the emulator network throttling and real devices on poor connections, and track failure rates by network type.
10
The backend team changed a field from a number to a string and the app crashed for all users. How do you prevent this?
Short term, make parsing lenient for that field, for example with a custom serializer, and handle parse failures without crashing. Long term, agree on API contracts with versioning, use contract tests or a shared OpenAPI schema checked in CI, add ignoreUnknownKeys and default values in kotlinx.serialization, and use remote config or a minimum supported app version mechanism. Monitor parse errors as non-fatal events.
11
How do you handle push notifications with Firebase Cloud Messaging?
Extend FirebaseMessagingService, override onNewToken to send the token to your server, and onMessageReceived to handle data messages. Notification messages are shown automatically by the system when the app is in background; data messages are always delivered to your code. Request POST_NOTIFICATIONS on Android 13 and above, create channels, and keep onMessageReceived short, using WorkManager for longer work triggered by the push.
12
Images in a feed load slowly and the app runs out of memory. What do you change?
Use an image library like Coil, which handles memory and disk caching, request downsampling to the view size, and cancellation when items scroll away. Ask the backend or CDN for resized, compressed images such as WebP instead of full-size originals. Use placeholders and crossfade, avoid holding Bitmaps in ViewModels, and set memory cache limits. Profile with Memory Profiler to confirm the large allocations are gone.
Use OkHttp MockWebServer to run a local server, enqueue responses with specific status codes, bodies and delays, and point Retrofit's base URL to it. Then call the API or repository and assert parsing, headers, error mapping and retry behaviour. Store sample JSON in test resources. For ViewModel tests, replace the repository with a fake instead of using MockWebServer, which keeps them fast.
14
Write a function that retries a suspend call with exponential backoff.
Anything shipped in the APK can be extracted, so treat client-side keys as public. Keep them out of version control using local.properties or CI secrets injected into BuildConfig, restrict them in the provider console by package name and SHA-1, and keep truly secret keys on your backend, which proxies the calls. Use Play Integrity or App Check to reduce abuse from modified apps.
16
A payment SDK integration fails only in release builds. What would you check?
First check R8 or ProGuard: release builds shrink and obfuscate code, and the SDK may need keep rules for classes used by reflection or JSON parsing. Check the SDK documentation for required rules and add them to proguard-rules.pro. Also verify the release signing key SHA is registered with the provider, the correct production keys and base URLs are used, and network security config allows the domains.
network_security_config.xml, referenced from the manifest, controls TLS behaviour without code. Since Android 9, cleartext HTTP is blocked by default; you can allow it for specific debug domains. You can trust user-added CAs only in debug builds for tools like Charles or proxies, and define certificate pins with expiry. Keeping cleartext disabled in production is an important security baseline.
18
Tell me about a time you worked closely with a backend team to solve a problem.
Situation: our feed took four seconds to load because the app made six API calls. Task: reduce load time. Action: I measured each call with network profiling, shared a timeline with the backend team, and we agreed on one aggregated endpoint with only the fields the screen used, plus pagination. I updated the client and added caching. Result: load time dropped to under one second and both teams reused the approach.
19
Describe a situation where you had to push back on an unrealistic deadline.
Situation: product wanted offline mode in one week. Task: give a realistic plan. Action: I broke the work into tasks with estimates, showed that sync conflicts and migrations alone needed two weeks, and proposed a smaller first release with read-only offline caching in one week. Result: we shipped the smaller version on time and the full offline sync three weeks later without quality issues.
20
How do you refresh an expired access token automatically?
Use an OkHttp Authenticator, which is called when the server returns 401. Inside it, synchronise so only one refresh runs at a time, call the refresh endpoint with the refresh token, save the new tokens and return the original request with the new header. If the request already carried the latest token and still failed, or refresh fails, return null and log the user out. Limit retries to avoid loops.
21
How does certificate pinning work and what are its risks?
Certificate pinning makes the app trust only specific public key hashes for your domain, using OkHttp CertificatePinner or the Network Security Config pin-set. It protects against attackers with a rogue or user-installed CA intercepting traffic. The risk is that if the server certificate changes and the pin does not match, all users lose connectivity until they update. Always pin a backup key and set an expiration for config-based pins.
22
Your app shows duplicate orders when users tap Pay twice on a slow network. How do you fix it?
Disable the button and show progress once tapped, but do not rely only on the UI. Generate an idempotency key on the client for each checkout attempt and send it with the request so the server returns the same result for retries. Ensure the payment call is not retried automatically by OkHttp for non-idempotent POSTs, and let the user check order status if the response is lost.
23
How would you implement real-time order tracking updates in an app?
Options are polling, WebSockets, Server-Sent Events, or push notifications. For a live tracking screen, a WebSocket via OkHttp exposed as a callbackFlow works well, started when the screen is visible and closed when it leaves. Add reconnection with backoff, heartbeat pings, and fall back to polling on failure. When the app is in background, rely on FCM pushes for status changes instead of keeping the socket open.
24
The API team wants to switch to GraphQL. What changes on the Android side?
You would use a client like Apollo Kotlin, which generates type-safe models from the schema and queries at build time, and supports normalised caching and coroutines. Benefits are fetching exactly the fields a screen needs and fewer round trips. Costs include learning the tooling, more complex caching and error handling since errors can come with partial data. I would pilot it on one feature before migrating everything.
25
How do you design an Android client to support API versioning and forced updates?
Send the app version in a header on every request, have the backend support older versions for a defined period, and use versioned endpoints for breaking changes. Add a remote config value for minimum supported version and use the Play In-App Updates API with immediate flow for critical updates and flexible flow otherwise. Show a clear message rather than failing silently when the app is too old.
Frequently asked questions
How important is Networking and APIs in Android App Development interviews?
Android apps talk to backends through REST, GraphQL, WebSockets and push notifications. This topic covers Retrofit, OkHttp interceptors, token refresh, JSON serialization, error handling, certificate pinning, image loading, FCM and designing for slow networks. Expect scenario questions about failures, retries and keeping user data safe.
How should I use the Networking and APIs sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.