Ktor Is Just Kotlin, All the Way Down
Meet Ktor — JetBrains' lightweight, coroutine-first framework for Kotlin backends. Why it feels different from Spring, and your first server in a handful of lines.
Building APIs with Ktor
Build real-world backends and APIs in Kotlin with Ktor — from your first route to production.
-
-
From Zero to a Running Server: Setting Up Ktor
Bootstrap a real Ktor project with Gradle and IntelliJ — the project generator, the build file, the two ways to start a server, and live reload while you code.
-
Routing: Turning URLs Into Code
The Ktor routing DSL from the ground up — HTTP verbs, path and query parameters, nested routes, and how to split your routes into clean, composable functions.
-
The Anatomy of a Call: Requests and Responses
Everything flows through `call`. Read headers and bodies from the request, and reply with the right status codes, content types, and headers from the response.
-
Speaking JSON: Content Negotiation in Ktor
Install one plugin, annotate your data classes, and Ktor serializes Kotlin objects to JSON and parses JSON back into objects — no manual string wrangling.
-
Your First Real API: CRUD, End to End
Routing, JSON, and status codes come together into a complete task API — list, fetch, create, update, and delete — backed by a clean repository.
-
Before module() Becomes a Monster
Ktor gives you no structure — that's your job. Split configuration into focused extension functions, organize by concern, and read typed values from application.yaml.
-
One Place for Things Going Wrong: StatusPages
Stop scattering error responses through every handler. Throw meaningful exceptions, map them to status codes and clean JSON in one plugin, and keep your routes about the happy path.
-
Giving Your Data a Home: Persistence with Exposed
Swap the in-memory map for a real SQL database using Exposed, JetBrains' Kotlin SQL framework — tables as objects, type-safe queries, and transactions that play nicely with coroutines.
-
Who Builds the Objects? Dependency Injection in Ktor
Ktor has no DI container — and that's fine until it isn't. Start with honest manual wiring, add a service layer, then graduate to Koin when hand-threading dependencies stops scaling.
-
Locking the Doors: JWT Authentication
Issue signed tokens at login, verify them on protected routes with Ktor's Authentication plugin, and read the logged-in user out of the request — the standard auth flow for APIs.
-
Don't Trust the Client: Validation and Security
Reject bad input before it reaches your logic with RequestValidation, open your API to browsers safely with CORS, and survive the public internet with rate limiting and sane headers.
-
Flying With Instruments: Logging and Metrics
When production misbehaves, you need to see inside. Add request logging, trace a single request across log lines with a call ID, and expose Prometheus metrics — all as plugins.
-
Calling Out: The Ktor HTTP Client
Ktor isn't just a server. The same library gives you a coroutine-based HTTP client for calling other APIs — with JSON, timeouts, and defaults configured the way you'd expect.
-
Keeping the Line Open: WebSockets
Request/response can't push. WebSockets give you a persistent, two-way channel — perfect for live updates and chat. Echo a message, then broadcast to every connected client.
-
Proving It Works: Testing Ktor Apps
Ktor runs your whole app in-memory for tests — no ports, no network, no waiting. Test routes with a real HTTP client, assert on JSON, exercise auth, and swap in fakes.
-
Shipping It: From Fat JAR to Production
Package your Ktor app into a single runnable JAR, wrap it in a Docker image, drive its config from environment variables, and walk the checklist before it faces real traffic.