Tearing down Reddit’s iOS application - Insights on APIs, Performance, Security, and A/B Experiments

I found Reddit’s iOS app experience better than the web version, so I thought of checking how it loads data so fast. Here is the teardown of Reddit’s iOS app.

Here are some highlights:

• It uses Token-based authentication.
• It uses GraphQL APIs for almost everything from configuration & experiments to post info.
• It monitors the performance of its API system as experienced by its users using an API named w3-reporting.
• In most of the GraphQL API calls only the operation name is passed without variables, I am assuming they are using middleware to abstract the configuration of the variables from front-end. A backend service is filling in info based on the operation name.
• Reddit uses Web Socket for the live comments feature.

Here is the detailed teardown of the API calls. I used Requestly’s Desktop App to intercept Reddit’s iOS app, setup instructions are provided here.

Technology Used

Reddit App is created with

• Reddit’s iOS app uses GraphQL APIs to load all the content.
• Token-based authentication is used for validating users.
• Performance Monitoring by reporting the API performance at the user end.
• Live commenting is supported using WebSocket.
• Dynamic Configuration to remotely control app behaviour without deploying new versions.
• Dynamic Experiments to remotely control experiments, not needing new deployment to change the status of an experiment.

Better UX with Preloading

The main question I had was how the app is performing so fast was answered upon checking FeedPostDetailsByIds API’s response. This API is called on the home screen with the ids of the posts shown and comes with detailed info that is shown after clicking the post. This preloading of the top posts helped in instantly showing the post details screen without any loader.

• Preloading posts are shown on the feed.
• The response time of the APIs is also very fast.

GraphQL APIs Security

GraphQL queries consist of the data and structure of the response needed. The operation name is generally optional. Most Reddit APIs have only operation names in the queries and variables are available only when there are on-screen variables/filters like feed with hot and latest post options.

This gives less control to frontend developers to make changes independently but more control over misuse of the APIs to fetch unnecessary data after all its user-facing API.

Remote Controlled Experiments

Running experiments on native iOS apps is difficult it needs re-deployments to enable or disable experiments, but Reddit has set-up the app in such a way that experiments can be controlled remotely. All the experiments are loaded in an API along with their values and statuses. The app automatically activates the variant of the experiment it assigned.

Flag-based Features Control

With so many users, experiments and features it's better to control them remotely. Reddit does a great job of controlling these features remotely.

At every launch of the app, it will call a configuration API to load 400+ configuration variables. Based on these variables it shows different features and variants of the features.

Secret of Karmas

The API with the operation name GetTopKarmaSubreddits gets the list of top subreddits with karma points earned in each. This API reveals how many comments and post karma we have gained from our activity in each sub-reddit. I could never find this information inside Reddit’s web and mobile UI.

Scope of Improvement

While reading the APIs to find what type of data it brings, I found SubredditFeedElements API loads the feed of the selected sub-reddit but with each post, it has a nested JSON of detailed sub-reddit information. This information is redundant and can be removed to reduce the network load of the API and further improve its performance.

Note: SubredditFeedElements API is now replaced by SubredditFeedSdui API and issue is fixed.

Use AI for Insights

I tried using ChatGPT to get some insights from the APIs. So created a file with all the APIs with their curl and their responses in it. Uploaded this file to a CustomGPT so that I can put any type of query. It gave some insights that were evident like what type of use an API might have and the structure of the response but it hallucinated a lot, most likely due to lots of APIs or I am no expert in prompting. Some of the insights given by AI:

1. GetAllExperimentVariants API — Many experiments have specific "variant" names, including options like enabled, variant_1, control_model, and one_feed_ph_bridge_new_users. This segmentation suggests that Reddit is testing features on particular user segments to determine their impact. For example, the experiment d2x_avatar_in_comments_loggedin has two variants, loggedin, and loggedout, potentially testing the feature based on the user authentication state.
2. GetAllExperimentVariants API — Experiments include hybrid_video_rollout_android_v2, active_sales, and gql_google_maps_integration, which point to a wide range of feature tests covering video functionality, ad placements, user interface enhancements, and third-party integrations
3. GetAccountDetails API — The API response contains various fields detailing the user’s account status, such as isSubredditCreationAllowed, isNameEditable, isPasswordSet, and the user's moderator status. Additionally, it includes suspensionExpiresAt and isSuspended, which indicate if an account is currently suspended or restricted

List of APIs

There are the list of GraphQL APIs I studied to understand how Reddit works. There were some other APIs as well like authentication, reporting etc. I didn’t include them in this list.

Conclusion

I would like to make couple of points in conclusion of this tear down experiment.

• Reddit’s APIs are not very fast instead they use preloading to give a better user experience.
• APIs work is never complete, even Reddit’s engineer have some work to do to further improve it.
• Keeping app & experiment configurations remotely can give a good control over user experience.
• Requestly’s engineers did a great job in showing operation name with each GraphQL Request, making life of devs much easier.