Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

A safe failover design starts from one distinction: a device being online does not mean your API is healthy. Android reports network transitions, the HTTP client recovers from some route failures on its own, and your app decides which endpoint to use, whether to retry, and whether a repeated request could cause harm. Each of those responsibilities belongs to a different layer, and mixing them is how a brief outage turns into a flood of duplicate requests, stalled screens, or double-applied writes.

Separate the five responsibilities

Most resilient Android clients contain five distinct mechanisms. They overlap in what they look like from the user’s side, but they answer different questions and fail in different ways.

Layer Question it answers What it does not do
OS network transitions Is there a usable network, and did it change? Tell you whether a specific API origin is responding
HTTP client route recovery Can this connection or address be replaced for the same request? Switch between separately configured API base URLs
Application endpoint selection Which origin should this app talk to right now? Decide safely on its own whether a write can be replayed
Retry policy Should this operation be attempted again, and how long should the app wait? Fix an expired credential or an invalid request
Persistent synchronization Can work that must not be lost wait until conditions are right? Make an interactive call complete immediately

The practical consequence is that each layer needs its own limits. A retry loop in application code that does not know the HTTP client already retried a connection will multiply attempts. A failover rule that switches origins on every timeout will move traffic in the middle of a write that the first origin may have already committed.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the operating system tells you, and what it cannot

Connectivity callbacks from ConnectivityManager tell the app that a network became available, changed capabilities, or was lost. They are signals for scheduling work and refreshing state. They are not an endpoint health check.

#1 Best Overall
Sale
Samsung Galaxy A17 5G Smart Phone 128GB US 1 Yr Manufacturer Warranty Black
  • YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
  • LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
  • MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
  • NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
  • BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.

Three caveats matter for design:

  • Do not query network state synchronously inside a callback. The API reference warns that values read this way can be outdated or null. Use the callback’s arguments, or re-query on a background path after the callback fires.
  • Do not rely on onLosing. It is not guaranteed to fire before a sudden loss, such as a radio dropping out, so the app must already handle a request that fails with no warning.
  • A network that is validated can still reach a dead API. Captive portals, DNS problems, a failed backend, and a TLS misconfiguration all leave the device “online” from the OS’s perspective.

Treat a transition as a reason to reconsider pending work, not as proof that the next request will succeed.

What the HTTP client already recovers

OkHttp can select an alternate route when connection establishment fails in limited cases, most commonly when a host resolves to several addresses. The OkHttp documentation describes this as transport recovery for that connection. It does not mean OkHttp will move a request from api.example.com to api-backup.example.com. Application-level origin switching is your code’s responsibility.

Before you add retries, check which client you actually use and which version it is. Your own loop should account for what the client already does. If the client may try several addresses inside one call, an application retry that adds another full attempt can produce more load than you intended. Count total attempts across both layers and bound them together.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Android’s media documentation recommends a single network-stack instance per app when using HttpEngine, Cronet, or OkHttp. That guidance sits in the media context, and the HttpEngine recommendation is explicitly tied to API 34 or S extensions 7. It is a useful reason to share one client instance, but it is not a universal rule for every Android network workload.

Rank #2
Tracfone Motorola Moto G 2025, 64GB, Saphire Blue (Locked to
  • Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
  • DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
  • CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
  • PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
  • BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.

Classify every failure before you retry

Retry decisions should start from the failure class, not from the exception type alone. The Android offline-first guidance recommends classifying network errors and setting a maximum retry count. It also says not to retry unauthorized requests until proper credentials are available.

Failure Typical signal Retry guidance
No route or DNS failure before the request is sent Connection or resolution exception Retry with bounded backoff; the request was not sent, so write safety is not the constraint
Timeout before any response Read or connect timeout with no status Retry only if the operation is safe to repeat (see write safety below)
Unauthorized HTTP 401 Do not retry until a credential remedy exists, such as a token refresh or a fresh sign-in
Invalid request Client-error statuses such as 400 or 422 Do not retry unchanged; fix the input or surface the error
Server overload or temporary unavailability Statuses such as 429 or 503 Often retryable; honor a Retry-After header when the API sends one. Which statuses are retryable depends on the API contract

No universal list of retryable status codes exists for Android. Each API defines its own status semantics, so the contract is the authority. Where the contract is silent, default to not retrying a status you cannot explain.

Check operation safety before replaying a write

A timeout does not prove that the server failed to apply a request. The client may have sent a payment or a record insert, and the response was lost on the way back. Replaying that write blindly can create a duplicate.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Before you retry a non-idempotent write, determine whether the server offers an idempotency key or another deduplication contract. The idempotency-key pattern is a general API engineering practice rather than something Android’s documentation specifies. The client sends a stable key with the request, and the server returns the original result for a repeat with the same key. Without that contract, the safe options are to retry only reads and idempotent updates, to ask the user before repeating an action, or to reconcile by querying the server for the resource’s state before deciding.

Rank #3
Sale
Samsung Galaxy A17 5G Smart Phone 128GB, US 1 Yr Manufacturer Warranty Blue
  • YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
  • LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
  • MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
  • NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
  • BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.

Bound recovery in attempts and time

Every retry loop needs two limits: a maximum attempt count and an overall time budget that fits the user-facing deadline. A screen that must respond in five seconds should not spend nine seconds on backoff.

Android’s offline-first architecture documentation describes exponential backoff this way:

“In exponential backoff, the app keeps attempting to read from the network data source with increasing time intervals until it succeeds, or other conditions dictate that it should stop.” (Android Developers, offline-first architecture documentation)

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The phrase “other conditions dictate that it should stop” is the important part. Backoff without a stop condition is just an endless loop with longer gaps. The following helper combines an attempt limit, a time budget, a failure predicate, and cancellation handling:

Rank #4
Sale
Samsung Galaxy S26 Ultra, Unlocked Android Smartphone, 512GB, Black
  • PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
  • TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
  • NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
  • MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
  • HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
import kotlinx.coroutines.CancellationException
import kotlinx.coroutines.delay

suspend fun <T> withBoundedRetry(
    maxAttempts: Int = 3,
    budgetMs: Long = 10_000L,
    initialDelayMs: Long = 500L,
    isRetryable: (Exception) -> Boolean,
    block: suspend (attempt: Int) -> T
): T {
    val start = System.currentTimeMillis()
    var delayMs = initialDelayMs
    var attempt = 1
    while (true) {
        try {
            return block(attempt)
        } catch (e: CancellationException) {
            throw e
        } catch (e: Exception) {
            val elapsed = System.currentTimeMillis() - start
            val outOfBudget = elapsed + delayMs > budgetMs
            if (attempt >= maxAttempts || outOfBudget || !isRetryable(e)) throw e
            delay(delayMs)
            delayMs *= 2
            attempt++
        }
    }
}

Pass a predicate that returns false for non-idempotent writes unless the server supports deduplication. If many devices retry at the same moment after an outage, add random jitter to each delay so they do not return in synchronized waves. The helper above omits jitter to keep the control flow visible.

Choose the right execution lifetime

Where the work happens determines how failures can be handled.

  • Interactive, latency-sensitive calls run in the foreground with a short budget. If they fail, show the failure and let the user retry. Deferring them silently changes their meaning, for example a “send” that never happens until later.
  • Durable synchronization should be written to local storage first and then sent by WorkManager. Android’s architecture guidance says WorkManager suits persistent work that can wait for connectivity and retry later. Use a connected-network constraint and a backoff policy, and keep a maximum retry count so unresolved work does not retry forever.
  • Cached reads can serve stale data while a refresh is attempted. This is acceptable only when the screen can show that the data may be old.

WorkManager is not a way to make an interactive request complete immediately. Its value is surviving process exit and waiting for conditions. If a user is waiting, keep the call in the foreground and fail visibly.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Application endpoint failover: when it is justified

Switching among separately configured API origins is a service design decision, and Android’s documentation does not define one. Before adding it, confirm that the alternate origin offers compatible API versions and data semantics, and that a write accepted by one origin will be visible through the other.

Best Value
Tracfone Moto g Play 2024 Prepaid Phone with a 1-Yr Plan Included
  • Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
  • ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
  • CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
  • PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
  • 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US

A usable design needs explicit answers to these questions:

  • Health criteria: what counts as unhealthy, such as consecutive timeouts, a 5xx rate over a window, or a failed TLS handshake. Thresholds are service-specific and should be measured against your own traffic.
  • State consistency: whether writes on one origin replicate before the other origin is used, and how conflicts are resolved.
  • Authentication and TLS: whether tokens are valid across origins, and whether certificates and pins cover every candidate host.
  • DNS behavior: whether a cached resolution can keep sending traffic to a dead address after failover.
  • Failback: when and how traffic returns to the primary. There is no standard interval. Choose one that avoids flapping and document it.

If the service cannot answer these questions, a cached read or an offline queue usually provides more safety than a second origin.

Observe and test the failure modes

Log enough to explain each failover decision without recording credentials or sensitive payloads. Useful fields include the selected endpoint identifier, attempt number, failure class, elapsed time, and recovery outcome. Log hostnames and error classes rather than full URLs when query parameters may contain personal data.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Test these conditions before release, because each one exercises a different layer:

  • DNS failure and an address that resolves but refuses connections
  • A timeout before any response arrives
  • A timeout after the server has applied a write
  • An expired token that returns 401, confirming there is no retry storm
  • Server overload returning 429 or 503 with and without Retry-After
  • A Wi-Fi-to-cellular transition during an in-flight request and during a queued sync

These are recommended test scenarios. They describe what to verify in your own app, not measured outcomes from any particular implementation.

Quick Recap

Practical checklist

  • Name the failover mechanism you actually need: route recovery, origin switching, cache, queue, or deferred work.
  • Confirm which recovery steps the HTTP client already performs, and count attempts across layers.
  • Classify each failure before deciding whether to retry.
  • Confirm idempotency or deduplication before replaying any write.
  • Set an attempt limit and a time budget that fit the user’s deadline.
  • Move durable work to WorkManager with connectivity constraints and a retry cap.
  • Add origin switching only with defined health, consistency, and failback rules.

“

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.