What are the possible/best ways to allow a production mobile app to switch API endpoint to a development server?

Question

Suppose I have a mobile app that uses an API at api.myapp.com. I want to be able to test the app on my personal dev machine mymac.local and also on a production-standard test server test.myapp.com.

What's the best way to allow a production mobile app to switch to an alternative API endpoint?

Options I've thought of with the cons I've thought of:

1. Put an Easter egg somewhere in the app that only devs know about. e.g. tap 5 times on the logo and an API endpoint input box pops up.

   Cons: Easter eggs get discovered.

2. Put a settings option in the normal settings menu (I think Twitter used to do this).

   Cons: Looks amateur?

3. Create an URL schema like myapp://change_api?endpoint=api.mysite.com

   Cons: This is a bit of a pain to use.

Are there other, better ways to do this that I haven't thought of?

Answer 1

It depends on the use-cases of the application. If its an app for kids, a 5 tap easter egg would get discovered in no time. But if its say, a financial app then its reasonably expected that no one would routinely discover the easter egg.

I personally like the easter egg option, as it adds an element of discovery and surprise for the user who discovers it, even if they don't have anything to do with it. May be add a couple of easter eggs in there anyway.

Answer 2

Write the code such that your build has a flag that switches URLs. Only release your build to yourself.

Answer 3

Minimise solving this through UX

If this app is going out to users, it's not a good idea to have anything in the code base that points to your local machine or a test machine.

I would suggest that:

• Add an invisible interaction sequence (eg tap corners of the screen in a particular order) to bring up a developer console. The key here is, the app has to be designed so that it's okay for that console to be accidentally or maliciously discovered.
• Console issues a call to the production server to your credentials to make sure you are a super user. Ie it checks your phone number, login credentials, secret API key, Android/iPhone identity or whatever identifying credentials you use to make sure it's you and not another user.
• If so, it issues you a token authorizing the use of the test API. If not it logs and quotas the call to guard against brute force attacks.
• The app then issues the normal API calls to the server, but with the additional authorizing token.
• Server checks for token, and if it's valid, then reroutes your API calls to local or test. This routing is done server side and not client side so your local and test machine IP addresses cannot be discovered.

I think this is a valid UX question since it could be solved using a pure-UX approach (eg admin passcode). But I think in this case a minimal, discovery-safe UX approach combined with server side security is better.

Answer 4

@awidgery Personally I think this is more of a technical question but I will try to answer it for you;

If your app is an Android app you will be able to use Gradle to switch your app between Production and Development. What you want to take a look at is build types.

If your app is an iOS app you should be able to do this using a Configuration File.

If you app is a Windows app then I don't know what you can do but I'm sure you can do something similar to the above.

If you are looking to be able to switch the app over from production to development within the app, I don't think thats a good idea as the production version should be simple to use for "real users" and not when developers want to do development or testing tasks. Just my opinion.

Sorry about all the if's and I hope it helps 👍