URLSession, Codable, Authentication, Real-Time Data, and Offline-First Apps

Read before you buy: the PDF here is a free sample — the first 20 pages of the 508-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Go beyond "fetch some JSON" and build an API layer you can ship and defend in a code review.

Getting a first request working in Swift takes ten lines. Getting networking right takes much more: requests that are built correctly, JSON that decodes even when the server surprises you, errors that make sense to users, retries that do not turn an outage into a storm, caching that saves data without showing stale information, sign-in with tokens that refresh safely under concurrency, live updates, and an app that keeps working in a tunnel.

This book teaches all of it through one realistic app. Every chapter adds a real capability, explains the HTTP behavior underneath it, and shows the actual traffic on the wire, so you understand why the code works — and how to debug it when it does not.

What's inside

• HTTP for app developers: methods, idempotency, status codes, headers, content negotiation, and REST resource design
• URLSession with async/await: requests, responses, status codes, timeouts, configurations, and cancellation
• Building requests correctly: URLComponents, percent-encoding traps, headers, JSON and form bodies
• Codable in depth: coding keys, nested and unkeyed containers, custom decoding, dates with and without fractional seconds, unknown enum values, and polymorphic JSON
• A typed API client: generic endpoints, one request pipeline, protocol-based injection, and SwiftUI loading states
• Errors and resilience: an error model for users and logs, API error bodies, retries with exponential backoff and jitter, Retry-After, and idempotency keys
• Pagination and search with cursors, debouncing, and cancellation
• Swift 6 concurrency for networking: Sendable models, actors, MainActor view models, task groups, and async streams
• Performance: HTTP caching with URLCache, Cache-Control, and ETags; an image pipeline with de-duplication and downsampling
• Uploads (JSON, binary, multipart with progress), resumable downloads, and background URLSession transfers
• GraphQL over plain URLSession, including partial errors
• Authentication: bearer tokens, OAuth 2.0 with PKCE and ASWebAuthenticationSession, Keychain storage, and single-flight token refresh with rotating refresh tokens
• Security and privacy: App Transport Security, TLS, certificate and public-key pinning, secrets, and log redaction
• Real-time data: WebSockets with URLSessionWebSocketTask, Server-Sent Events, and push notifications as a data trigger
• Offline-first: network path monitoring, local snapshots, and a durable sync queue with idempotent replays
• Testing and tooling: URLProtocol mocks, fixtures, Swift Testing, proxies, metrics, and the Swift OpenAPI Generator

One running example, start to finish. You build Railbird, a departures app for the fictional city of Larkhaven, against a fictional REST API that is specified down to every endpoint, header, and JSON field. A small Python mock server (standard library only) runs on your Mac and serves deterministic data — a fixed 8:00 AM departure board at Central Station — plus OAuth sign-in, uploads, resumable downloads, WebSockets, Server-Sent Events, and fault injection for testing errors and retries. The mock server and an OpenAPI document for the API are included with your download.

Current and honest. The code targets the Swift 6 language mode, iOS 18 as the minimum deployment version, and Xcode 26-era tooling, with newer iOS 26 features clearly marked and hedged. Standards are cited by RFC number, draft specifications are labeled as drafts, and the book contains no invented benchmarks or statistics. Every chapter includes Swift code, real HTTP traces, Tips, Notes, Warnings, exercises, and Key Takeaways, and the appendices give you a cheat sheet, the full API reference with reusable code templates, a production checklist, and a glossary.

Format: PDF, 508 pages (A4), linked table of contents and bookmarks. English. First Edition, 2026. Published by thenexbooks. Includes the Railbird mock server (Python) and OpenAPI document. Requires a Mac with Xcode to run the iOS code. This book is independent and is not affiliated with, sponsored by, or endorsed by Apple Inc.

Table of Contents

Part I — HTTP and URLSession Foundations

• Ch 1 · How Apps Talk to Servers: HTTP, REST, and the Railbird API
• Ch 2 · URLSession with async/await: Requests, Responses, and Status Codes
• Ch 3 · Building Requests Right: URLs, Query Items, Headers, and Bodies
• Ch 4 · Codable in Depth: Coding Keys, Nested Containers, and Custom Decoding
• Ch 5 · Real-World JSON: Dates, Optional Fields, Unknown Values, and Polymorphic Payloads

Part II — A Production API Client

• Ch 6 · Designing a Typed API Client: Endpoint, APIClient, and Protocols
• Ch 7 · Errors That Make Sense: HTTP Errors, API Error Bodies, and User Messages
• Ch 8 · Resilient Requests: Timeouts, Retries, Exponential Backoff, and Cancellation
• Ch 9 · Pagination, Search, and Loading State in SwiftUI
• Ch 10 · Networking and Swift 6 Concurrency: Actors, MainActor Models, and Task Groups

Part III — Performance and Data Transfer

• Ch 11 · HTTP Caching: URLCache, Cache-Control, and ETags
• Ch 12 · Loading, Caching, and Displaying Remote Images
• Ch 13 · Uploads: JSON, Binary Bodies, Multipart Forms, and Progress
• Ch 14 · Downloads, Resumable Transfers, and Background Sessions
• Ch 15 · GraphQL over URLSession: Queries, Variables, and Partial Errors

Part IV — Authentication and Security

• Ch 16 · Authentication Fundamentals: API Keys, Sessions, and Bearer Tokens
• Ch 17 · Sign In with OAuth 2.0, PKCE, and ASWebAuthenticationSession
• Ch 18 · Tokens in the Keychain: Storage, Refresh, and Single-Flight Renewal
• Ch 19 · Transport Security: App Transport Security, TLS, and Certificate Pinning
• Ch 20 · Protecting Users on the Wire: Secrets, Logging, and Privacy

Part V — Real-Time and Offline

• Ch 21 · Live Updates with WebSockets and URLSessionWebSocketTask
• Ch 22 · Server-Sent Events and Streaming Responses
• Ch 23 · Push Notifications as a Data Trigger
• Ch 24 · Offline-First Railbird: Path Monitoring, Local Snapshots, and a Sync Queue

Part VI — Testing, Tooling, and Shipping

• Ch 25 · Testing Networking Code: URLProtocol Mocks, Fixtures, and Swift Testing
• Ch 26 · Debugging Network Traffic: Proxies, Logs, Metrics, and the Mock Server
• Ch 27 · Generating Clients from OpenAPI with Swift OpenAPI Generator
• Ch 28 · Case Study: Shipping Railbird — Architecture Review and Production Checklist

Appendices
A · Networking Cheat Sheet
B · Railbird API Reference and Code Templates
C · Production Networking Checklist
D · Glossary

Book details