You added an OPDS feed and BookShelves either won’t load it, or shows a warning next to the URL when you’re saving it. If the URL starts with http://, that’s almost always why.
This is an Apple rule, not a BookShelves rule. We can’t override it, and shouldn’t — but there are a few straightforward ways around it.
Why Apple blocks http://
Every app on iPhone, iPad, and Mac runs behind something Apple calls App Transport Security (ATS). ATS refuses cleartext (http://) connections to public servers. The goal is to make sure your reading list, your credentials, and your book traffic can’t be read by anyone sitting on the same Wi-Fi, or intercepted upstream.
BookShelves does allow http:// in one specific case: servers on your own local network. Everywhere else, Apple requires https://.
The same rules apply on macOS, iOS, and iPadOS. If a feed loads on your Mac but not your iPhone, the most common reason isn’t ATS — it’s that your Mac and iPhone are on different networks, so a LAN-only server that your Mac can reach is simply unreachable from your phone.
Four ways to make it work
1. Ask the feed operator to enable HTTPS
This is the right fix for any public OPDS catalog. If you’re using a hosted catalog (Standard Ebooks, a public library, a bookstore), they already serve HTTPS — if yours doesn’t, let them know. Most modern servers can add free certificates in minutes.
2. Use a .local hostname (Bonjour / mDNS)
If your OPDS source is on your home network and advertises itself via Bonjour (most do), you can use its .local name directly:
http://mylaptop.local:8080/opds
http://bookserver.local:8080/opds
Apple treats .local hostnames as local-network and allows http://. This is usually the most stable option — the name keeps working even if the server’s IP address changes.
3. Use a LAN IP address
If Bonjour isn’t available or you don’t know the .local name, use the server’s local IP address:
http://192.168.1.50:8080/opds
http://10.0.0.42:8080/opds
Only addresses in these ranges count as local:
10.0.0.0–10.255.255.255172.16.0.0–172.31.255.255192.168.0.0–192.168.255.255127.0.0.0–127.255.255.255(loopback)169.254.0.0–169.254.255.255(link-local)
A public domain name that happens to resolve to a private IP does not count — Apple decides from the URL alone, not from DNS.
The downside is that your router may hand out a different IP next time the server restarts. A DHCP reservation in your router avoids that.
4. Put HTTPS in front of your server
If you want to reach a home OPDS server from outside your network, you need HTTPS anyway. Any reverse proxy with a Let’s Encrypt certificate works — nginx, Caddy, and Traefik are common choices. Mesh-VPN products like Tailscale and commercial tunnels like Cloudflare Tunnel can also terminate HTTPS for you without opening ports on your router.
We don’t recommend one setup over another — any of them will satisfy ATS.
Why doesn’t BookShelves just add an exception?
Apps can ask the system to exempt specific domains from ATS. BookShelves deliberately doesn’t do that for user-added OPDS feeds, for two reasons:
- We don’t know your feeds in advance. A blanket exception would weaken security for every user to help the few who use
http://. - It wouldn’t pass review forever. Apple’s App Review continues to tighten ATS policy, and a blanket exception is a standing risk to keeping BookShelves in the App Store.
The local-network exemption is built into Apple’s platforms and does not require any special entitlement beyond what BookShelves already uses — which is why .local and private-IP feeds still work.
Still stuck?
If you’ve tried the above and your feed still won’t load, let us know on the feedback page — include the URL (scrub the hostname if you’d rather) and we’ll help diagnose it.