You added an OPDS feed and BookShelves either won’t load it, or shows a warning under the URL while you’re adding it (“Apple only allows https:// for public servers”). If the URL starts with http://, that’s almost always why.
This is an Apple rule, not a BookShelves rule. We can’t override it, and shouldn’t — but there are a few straightforward ways around it.
New to OPDS in BookShelves? Start with Add an OPDS Catalog.
Why Apple blocks http://
Every app on iPhone, iPad, and Mac runs behind something Apple calls App Transport Security (ATS). ATS refuses cleartext (http://) connections to public servers. The goal is to make sure your reading list, your credentials, and your book traffic can’t be read by anyone sitting on the same Wi-Fi, or intercepted upstream.
BookShelves does allow http:// in one specific case: servers on your own local network. Everywhere else, Apple requires https://.
The rule is the same in the Mac, iPhone and iPad apps. If a feed loads on your Mac but not on your iPhone, the usual reason isn’t ATS: the two devices are on different networks, and a server that only your home network can reach is out of reach from your phone.
Four ways to make it work
1. Ask the feed operator to enable HTTPS
This is the right fix for any public OPDS catalog. If you’re using a hosted catalog (Standard Ebooks, a public library, a bookstore), they already serve HTTPS — if yours doesn’t, let them know. Most modern servers can add free certificates in minutes.
2. Use a .local hostname (Bonjour / mDNS)
If your OPDS source is on your home network and advertises itself via Bonjour (most do), you can use its .local name directly:
http://mylaptop.local:8080/opds
http://bookserver.local:8080/opds
Apple treats .local hostnames as local-network and allows http://. This is usually the most stable option — the name keeps working even if the server’s IP address changes.
A single-word hostname with no dots, such as http://nas:8080/opds, also counts as local, and so does localhost.
3. Use a LAN IP address
If Bonjour isn’t available or you don’t know the .local name, use the server’s local IP address:
http://192.168.1.50:8080/opds
http://10.0.0.42:8080/opds
Only addresses in these ranges count as local:
10.0.0.0–10.255.255.255172.16.0.0–172.31.255.255192.168.0.0–192.168.255.255127.0.0.0–127.255.255.255(loopback)169.254.0.0–169.254.255.255(link-local)
Local IPv6 addresses count as local too: ::1, link-local addresses (fe80:...) and private addresses (fc..: or fd..:).
A public domain name that happens to resolve to a private IP does not count — Apple decides from the URL alone, not from DNS.
The downside is that your router may hand out a different IP next time the server restarts. A DHCP reservation in your router avoids that.
4. Put HTTPS in front of your server
If you want to reach a home OPDS server from outside your network, you need HTTPS anyway. Any reverse proxy with a Let’s Encrypt certificate works — nginx, Caddy, and Traefik are common choices. Mesh-VPN products like Tailscale and commercial tunnels like Cloudflare Tunnel can also terminate HTTPS for you without opening ports on your router.
We don’t recommend one setup over another — any of them will satisfy ATS.
Why doesn’t BookShelves just add an exception?
Apps can ask the system to exempt specific domains from ATS. BookShelves deliberately doesn’t do that for user-added OPDS feeds, for two reasons:
- We don’t know your feeds in advance. A blanket exception would weaken security for every user to help the few who use
http://. - It wouldn’t pass review forever. Apple’s App Review continues to tighten ATS policy, and a blanket exception is a standing risk to keeping BookShelves in the App Store.
The local-network exemption is built into Apple’s platforms and does not require any special entitlement beyond what BookShelves already uses — which is why .local and private-IP feeds still work.
Still stuck?
If you’ve tried the above and your feed still won’t load, let us know on the feedback page — include the URL (scrub the hostname if you’d rather) and we’ll help diagnose it.