Apple Integration Is a Boundary, Not a Feature
Apple integrations are boundary designs: native capability, server-side mapping, and trust checks must meet a platform-agnostic product layer. See where each responsibility belongs.
Loading…
Topic
iOS
74 posts about iOS. Every summary links to the original.
- 74 posts
- 24 companies
- 1 explainer
See the idea
iOS explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
How we improved our iOS CI infrastructure with observability tools
Upgrading to Xcode 13.1 introduced severe CI test instability and high CPU utilisation for Grab's iOS development team. To address this, the team integrated observability tools across their UITest pipeline to pinpoint performance bottlenecks and test flakiness. Interventions included isolating spotlight.app to curb CPU spikes, replacing Safari with a mock browser for deep link tests, and booting simulators with pre-granted permissions. The team also built custom network tracking tools to enforce resource mocking and transitioned tests away from arbitrary sleep commands to explicit wait wrappers. These combined changes cut CI runtimes, decreased CPU utilisation by over 50%, and stabilized automated test executions.
Securing your Flutter apps with Multi-Factor Authentication
The tutorial presents a Flutter app that requires multi-factor authentication before users can view its content, using email and password login followed by authenticator-app verification. It uses Supabase for authentication, supabase_flutter for client integration, go_router for routes and redirects, and flutter_svg to display a QR code for authenticator enrollment. During signup, users confirm their email through a deep link, enroll MFA, and then verify a code; login applies a similar second step. iOS and Android deep-link configuration directs the confirmation callback to the enrollment route, while routing checks the session and authenticator assurance level to send users to registration, enrollment, or verification as appropriate. The stated outcome is that only users who have signed in via MFA can access the home page, while optional MFA is identified as a possible future variation.
Supabase Auth: SSO, Mobile, and Server-side support
Supabase Auth announces SAML 2.0 Single Sign-On, PKCE support for server-side rendering and mobile authentication, and native Sign in with Apple on iOS. SSO lets users authenticate through a company identity provider, with dashboard configuration, Supabase CLI commands, a `signInWithSSO()` call, and PostgreSQL Row Level Security support using the provider identifier in a user JWT. PKCE addresses implicit-flow risks with a code verifier, code challenge, authorization code, and server-side exchange for a session, enabling same-domain cookies, protected server-rendered pages, and downstream actions after authentication. The release also allows an iOS Bundle ID to be configured for Apple provider access and supports `supabase.auth.signInWithApple()` in supabase-flutter without deep links or parameters. SSO is available on the Pro Plan and above and self-hosted, while server-side Auth using PKCE is now available on all projects.
Supporting Passkeys in Shop's Authentication Flows
Shop Pay and the Shop app began deploying passkeys in December 2022 across web and native app authentication, initially as an additional method for existing users and as a replacement for email and SMS verification. Passkeys use public-key cryptography: the private key remains on the device, while the service stores a public key, with platform or roaming authenticators providing options such as biometrics or hardware keys. Built on Ruby on Rails, Shop used webauthn-ruby to store a server challenge during registration, verify the allowed domain and challenge, and save the credential identifier; login looks up that identifier and verifies authentication while updating the sign count. The team also integrated passkeys into an iframe-capable login component for use across Shopify interactions, including merchant storefronts. Domain scoping, authenticator settings, challenge handling, Conditional UI, and cross-device interoperability are identified as important implementation considerations.
Geo Queries with PostGIS in Ionic Angular
This tutorial shows how to build an Ionic Angular cross-platform app that stores and queries store locations with Supabase and PostGIS. It enables PostGIS, defines a stores table with a geography(POINT) location, adds a GiST spatial index, creates storage policies, and seeds example coordinates. SQL functions named nearby_stores and stores_in_view calculate distances or select stores inside a coordinate box, while Ionic uses Capacitor Google Maps and geolocation to display markers and query nearby data. The app also uploads store images to Supabase Storage, retrieves them with a 300-pixel contain transformation, and opens store details in an Ionic bottom-sheet modal after marker selection. The completed code is provided on GitHub and requires project and Google Maps credentials plus the included SQL.
Catching Anomalies Early in Mobile App Releases
Nextdoor deploys weekly mobile updates across iOS and Android using phased rollouts starting at 1% adoption to minimize blast radius. Standard aggregate observability cannot reliably detect early regressions because early adopters skew significantly more active than average users, obscuring silent drops in overall metric noise. To overcome this selection bias, Nextdoor built App Release Anomaly Detection using difference-in-differences causal inference. The methodology verifies pre-adoption trends with standard deviation bounds and fits a linear regression model to estimate the effect against an unobserved counterfactual. During a rollout of iOS version v1.234.5, this model identified a statistically significant app session decline at 1% adoption, isolating the regression 10 days earlier than week-over-week metrics.
Building Obsidian, Tinder’s Design System
As Tinder scaled over a decade, maintaining visual consistency across its client applications became unsustainable and increased engineering overhead. To address this, the UI Platform team developed Obsidian, a unified design system combining design tokens, reusable components, and documentation. Designers define base and context tokens in Figma using the Tokens Studio plugin, which are then transformed by Style Dictionary into native artifacts for iOS, Android, and Web. Web developers integrate these tokens using Atomizer to generate static stylesheets, while a Zeroheight documentation portal and a custom token lookup tool assist legacy migrations. The ongoing migration has streamlined collaboration between designers and engineers, resolved styling ambiguities, and improved color contrast accessibility across platforms.
Migrating our Largest Mobile App to React Native
Shopify’s largest mobile app, Shopify Mobile, had 300 screens per platform and more than six years of development, making a full rewrite impractical because it could take at least three years and halt feature work. The team first adopted React Native incrementally, but migration was projected to take four to five years while requiring three design-system implementations, three architectures, and costly native interoperability. It then switched to “Iterative Porting”: engineers were trained through the five-milestone RN Accelerator, surfaces were inventoried and prioritized with a RICE-based score, and eligible features were migrated behind flags, tested, monitored for two weeks, then completed by removing the native version. The effort also introduced Native Routes, modal deeplink handling on iOS, and component-level Safe Area fixes; with root screens ported and infrastructure in place, the team reports that ports are accelerating, although substantial work remains.
Flutter Authorization with RLS
This tutorial extends a Flutter real-time chat app by adding authorization and one-to-one conversations backed by Supabase. It introduces a rooms page for starting conversations and listing existing rooms, while flutter_bloc coordinates profile and message data across the rooms and chats pages. The database changes add rooms and room_participants tables, connect messages to rooms, expose create_new_room for reusing or creating a two-user room, and register deep links for email confirmation on iOS and Android. SQL RLS policies then restrict room, participant, and message reads to participants and require message inserts to use the caller's profile ID, producing a real-time chat app with authentication and authorization.
Lessons From Building iOS Widgets
Shopify’s widget team describes a third-generation redesign for iOS and Android after the original iOS widgets offered only two metrics and consumed substantial space. The widgets target merchants who need fresh shop analytics, using native SwiftUI on iOS because WidgetKit extensions have memory constraints, serialize SwiftUI view hierarchies to disk, and lacked official React Native support. Independent widget-side fetching uses shared session-management code and tokens; repeated update callbacks caused duplicate network requests and token-refresh races, so the team introduced a short-lived, widget-specific cache. Replacing existing widgets also exposed migration limits: changing widget kind identifiers could blank or remove installed widgets, leading Shopify to deprecate old widgets while releasing new ones and guide merchants through the transition. The team planned further customization and integration with iOS 16 features, including watch and lock-screen complications and live activities.
Supabase Flutter SDK 1.0 Developer Preview
Supabase released the Developer Preview of version 1.0 for its Flutter SDK, prioritizing improvements to developer experience across Dart applications. The new version eliminates the need for boilerplate state classes, automating authentication state persistence and deep link processing directly after initialization. To better align with Dart conventions, the SDK now throws exceptions across auth, storage, and Postgrest instead of returning error objects, while also deprecating the .execute() method for database queries. Switching to the app_links library expands deep linking support to macOS and Windows alongside existing mobile and web platforms. Supabase also introduced a companion Auth UI library for prebuilt authentication interfaces and announced plans to integrate the Multiplayer Realtime engine in the stable release.
Flutter Tutorial: building a Flutter chat app
Developers can construct cross-platform real-time chat applications for iOS, Android, and web by pairing Flutter with Supabase. The architecture relies on Supabase to manage authentication and provide direct SDK access to a Postgres database without requiring custom backend server code. The database schema defines profiles with regex validation constraints and a messages table configured for live subscriptions through Postgres publication settings. Flutter clients capture user input, insert new records into the messages table, handle database exceptions, and format chat bubbles with dynamic timestamps. While this initial setup implements user registration and message broadcasting in a shared room, securing chat rooms requires subsequent row-level security configuration.
React Native Skia—For Us, For You, and For Fun
React Native Skia brings Skia’s cross-platform 2D drawing primitives to React Native, with the stated goals of improving its limited graphical capabilities and aligning designers and developers around capabilities comparable to Figma. The integration uses React Native’s JavaScript Interface (JSI), enabling direct JavaScript-to-native communication through C++ rather than asynchronous messages, and exposes an API described as virtually 100% compatible with Flutter’s. On top of the imperative API, a declarative layer uses the React Reconciler to diff internal representation states and send changes to the Skia engine, supporting composable drawings and declarative optimizations. The library includes image filters, shaders, SVG, path operations, vertices, text layouts, mesh gradients, shadows, backdrop blur, and animations, with a direct connector to Reanimated 2; the authors expect it to address a major React Native pain point and describe the work as just beginning.
Remote rendering: Shopify’s take on extensible UI
Shopify describes a UI extension architecture designed to give third-party code consistent, accessible, cross-platform experiences without allowing it to compromise the host application. Its remote-rendering approach separates UI definition from rendering, with extensions communicating with hosts through MessageChannel-based message passing; hosts are implemented in JavaScript, Kotlin, and Swift. The open-source remote-ui library supplies RPC for passing callbacks across postMessage, automatic memory management, a DOM-like RemoteRoot that serializes updates as JSON, and receivers that map remote components to DOM or React components. A sandbox isolates untrusted extension code and controls exposed APIs across web workers, Android web views, and iOS JsCore. The system powers product-subscription and post-purchase extensions, while a DOM-based version began releasing in July 2025.
Building an App Clip with React Native
The Shop team built an iOS App Clip to reduce the drop-off between a buyer’s checkout thank-you page and opening the full Shop app, where App Store download and onboarding added friction. App Clips are invoked through actions such as QR scans, links, or Smart App Banners and must stay below 10MB, while the team wanted React Native support for order tracking and related functionality. A Hello World build initially measured 28MB; explicitly selecting native dependencies in the Podfile reduced the baseline to 4.3MB, and a scrappy feature build reached 6.5MB. The team used early testing, invocation URL handling through React Native Linking, and shared data containers for app upgrades, ultimately releasing an App Clip at 9.1MB; extensive code sharing proved too complex and some code was copied.
Perspectives on React Native from Three Shopify Developers
Three Shopify developers—web developer AJ Robidas, Android developer Michelle Fernandez, and iOS developer Ash Furrow—describe how React Native changes mobile development for people from different backgrounds. They say its React-based model lets web developers build for iOS and Android, helps native developers create interfaces faster and reach a wider audience, and supports collaboration across web, Android, and iOS teams. The developers discuss surprises including React Native’s small set of building blocks, fast UI feedback, native bridge modules, existing SDK integration, and apps that can be difficult to distinguish from Swift or Objective-C software. They also identify challenges such as mobile-specific performance concerns across the RN Bridge, the Metro and Node ecosystem, and the large dependency stack. At Shopify, Visual Studio Code, command-line tooling, internal foundations, workshops, and cross-disciplinary teams support adoption.
How Grab is Blazing Through the Superapp Bazel Migration
Grab's mobile superapp scaled past 2.5 million lines of code across both Android and iOS, leading to unsustainable local and CI build times under Gradle and Xcode. To address these bottlenecks, the engineering team analyzed their dependency trees and introduced an internal tool to calculate and optimize the build critical path. They also deployed a Kubernetes-autoscaled remote build system using Mainframer for Android and implemented Test Impact Analysis to run only affected tests in pre-merge validation. While dependency decoupling yielded modest 7% to 10% gains and iOS remote builds proved unscalable on Apple hardware, Android remote builds reduced local compile times by up to 50%, and targeted test execution reduced pre-merge pipeline durations by more than 30%.
How We Built Size.link
Size.link is a free Shopify AR tool that lets shoppers view a product’s dimensions in their surroundings through a smartphone camera. It was created during April Hack Days as a quick alternative to commissioning 3D models, with requirements including browser-based operation, speed, accuracy, and iOS and Android support. Because iOS lacks JavaScript WebAR, the implementation uses AR Quick Look with USDZ files and Android’s Scene Viewer with GLB files. Rather than generate files dynamically with slow USDZ tooling or pre-generate billions of dimension combinations, the team modifies binary template data, replacing scale or vertex float values to resize the cube while preserving its outline. The resulting Ruby server generates USDZ files in well under one millisecond, and the same strategy produces GLB files; future work could add textures for standard-sized products.
Developer Platform updates Spring 20'
Zoom introduced several updates across its developer platform alongside new roadmap milestones for 2020. Marketplace enhancements include a Developer Dashboard tracking install numbers and API usage, as well as dynamic OAuth scope configurations that distinguish mandatory and optional permissions. For client development, the WebSDK adds Microsoft Edge Chromium compatibility with video and VOIP support, whereas the iOS SDK incorporates Xcode 11 support. Due to increased developer demand, Zoom updated its V2 REST API rate limits and delivered new chat webhooks tracking message, channel, and member activity. Upcoming platform initiatives include the permanent termination of all legacy V1 APIs on May 31, 2020, platform security enhancements, and an iframe-free JavaScript embedding framework for the WebSDK.
Tackling UI Test Execution Time Imbalance for Xcode Parallel Testing
Parallel test execution in Xcode can suffer from test time imbalance when tasks finish at significantly different times across parallel simulator workers. Analysis of Xcode scheduling logs shows that the runner groups tests by test class and dispatches all tests from the same class to a single simulator. Attempts to customize the suite by swizzling XCTestSuite fail because made-up suites initialize only after tests are dispatched. To overcome this grouping constraint, unique tokens or test names are appended to the class name component in `-only-testing` command-line arguments. This trick forces Xcode to treat each test as an independent class, successfully distributing individual tests across separate workers.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.