Explain Retrofit Interceptors and write a static API key interceptor

What's really being asked

This question probes whether you understand that Retrofit delegates its HTTP layer to OkHttp, and that interceptors are OkHttp's hook for cross-cutting concerns like authentication, logging, and retry logic. The interviewer wants to see that you know the difference between application interceptors and network interceptors, and that you can correctly implement the chain of responsibility pattern without breaking the request flow.

The full answer

First, define the purpose: interceptors monitor, rewrite, and retry calls. Second, write the implementation by creating a class that implements Interceptor, obtaining the original request with chain.request(), building a new request via request.newBuilder().addHeader("X-Api-Key", "your_key").build(), and returning chain.proceed(newRequest). Third, explain that chain.proceed is where all HTTP work happens and must be called exactly once per interceptor pass unless you are explicitly retrying, in which case previous response bodies must be closed. Fourth, contrast registration methods: addInterceptor is an application interceptor that runs once on the original request and sees the final redirected response, while addNetworkInterceptor runs once per network hop and exposes lower-level details like the Connection object and raw headers such as Accept-Encoding.

The mistakes people make

A major red flag is mutating the original request object instead of building a new one with the builder. Another is forgetting to call chain.proceed and returning a synthetic response without continuing the chain, which breaks the entire stack. Some candidates incorrectly treat interceptors as Retrofit annotations or claim they belong to Retrofit rather than OkHttp. Also, failing to mention that multiple interceptors execute in the order they were added is a sign of shallow knowledge.

What usually comes next

The interviewer may ask how you would refresh an OAuth token on a 401 response, which requires a careful retry pattern with response body closing. They might ask when to choose a network interceptor over an application interceptor, such as when you need to observe raw gzip-encoded bodies or per-hop metrics. Another follow-up is how to avoid adding the API key to specific requests, which you can handle by checking request headers or tags before mutation.

A concrete example

Suppose you register your API key interceptor via OkHttpClient.Builder().addInterceptor(ApiKeyInterceptor("abc123")).build(). When you call a Retrofit endpoint that hits http://example.com/data and receives a 302 redirect to https://example.com/data, the application interceptor runs once and chain.proceed returns the final 200 OK from the HTTPS URL. If you had used addNetworkInterceptor instead, the interceptor would run twice: once for the HTTP 302 and once for the HTTPS 200, logging two separate connections.