/////////////////////////////
object SafeHttpClient {
    private const val TAG = "STaxi.SafeHttpClient"

    val safeOkHttpClient: OkHttpClient
        get() {
            Log.d(TAG, "return builder.build()")

            return OkHttpClient.Builder()
                    .addInterceptor(NetInterceptor())
                    .build()
        }
}
//////////////////////////////
object RetrofitClient {
    private const val BASE_URL = "https://www.your.site/api/"
    private const val TAG = "RetrofitClient"

    val instance: Retrofit by lazy {
        Log.d(TAG, "instance = new Retrofit.Builder()....build()")
        Retrofit.Builder()
                .baseUrl(BASE_URL)
                .client(SafeHttpClient.safeOkHttpClient)
                .addConverterFactory(GsonConverterFactory.create())
                .addCallAdapterFactory(RxJava2CallAdapterFactory.create())
                .build()
    }
}
//////////////////////////////
class NetInterceptor : Interceptor {
    private val TAG = "NetInterceptor"

    @Throws(IOException::class)
    override fun intercept(chain: Interceptor.Chain): Response {
        val request = chain.request()

        when {
            request.method().equals("post", ignoreCase = true) -> {
                if (
                        request.url().encodedPath().equals("/api/login", ignoreCase = true) ||
                        request.url().encodedPath().equals("/api/registration/register", ignoreCase = true) ||
                        request.url().encodedPath().equals("/api/registration/resendCode", ignoreCase = true) ||
                        request.url().encodedPath().equals("/api/registration/confirm", ignoreCase = true) ||
                        request.url().encodedPath().equals("/api/payment/result", ignoreCase = true)
                ) {
                    Log.d(TAG, "post ${request.url().encodedPath()}")
                    return chain.proceed(request.newBuilder()
                            .build())
                }
            }
            request.method().equals("get", ignoreCase = true) -> {
                if (
                        request.url().encodedPath().contains("/api/news", ignoreCase = true) ||
                        request.url().encodedPath().equals("/api/public/subscriptionTypes", ignoreCase = true)
                ) {
                    Log.d(TAG, "get ${request.url().encodedPath()}")
                    return chain.proceed(request.newBuilder()
                            .build())
                }
            }
        }

        val newRequest = request.newBuilder()
                .addHeader("Authorization", "Bearer ${AppEx.instance!!.shpToken}") // здесь токен подставляется
                .build()
        Log.d(TAG, "Auth ${request.url().encodedPath()}")
        Log.d(TAG, "Auth ${AppEx.instance!!.shpToken}")
        return chain.proceed(newRequest)
    }
}
//////////////////////////////////
interface AccountApi {

    @FormUrlEncoded
    @POST("login")
    fun login(
            @Field("username") username: String,
            @Field("password") password: String
    ): Observable<Response<Unit>>

    @FormUrlEncoded
    @POST("account/changePassword")
    fun changePassword(
            @Field("oldPassword") oldPassword: String,
            @Field("newPassword") newPassword: String
    ): Observable<Response<Unit>>

    @FormUrlEncoded
    @POST("account/usedSystems")
    fun updateUsedSystems(
            @Body jsonString: String
    ): Observable<Response<Unit>>

    @GET("auth/user")
    fun getAuthUserDetails() : Observable<Response<AuthUserDetailsDto>>

    @GET("account/person")
    fun currentPerson(): Observable<Response<PersonDto>>

    @GET("auth/ping")
    fun ping(): Observable<Response<Unit>>

}
/////////////////////////////////
// где-то в коде
// проверка последнего использованного токена
private fun ping() {
    compositeDisposable.add(accApi.ping()
                        .subscribeOn(Schedulers.io())
                        .observeOn(AndroidSchedulers.mainThread())
                        .subscribe(this::handlePingResponse, this::handlePingError)
}

private fun handlePingResponse(result: Response<Unit>) {
        when {
            result.isSuccessful -> {
                Log.d(TAG, "Authorization completed by log+pass+token")
                compositeDisposable.add(accApi.currentPerson()
                        .subscribeOn(Schedulers.io())
                        .observeOn(AndroidSchedulers.mainThread())
                        .subscribe(this::handleCurrentPersonResponse, this::handleCurrentPersonError)
                )
                compositeDisposable.add(accApi.getAuthUserDetails()
                        .subscribeOn(Schedulers.io())
                        .observeOn(AndroidSchedulers.mainThread())
                        .subscribe(this::handleAuthUserDetailsResponse, this::handleAuthUserDetailsError))
            }
            else -> login(AppEx.instance!!.shpLogin, AppEx.instance!!.shpPass)
    }
}

private fun handlePingError(error: Throwable) {
        Log.d(TAG, "handlePingError: ${error.message}")
        login(AppEx.instance!!.shpLogin, AppEx.instance!!.shpPass)
}
// и так далее