You can take a number of steps to ensure your API can't be called by a random client. These will be effective for 99.9% of the potential threats, but keep in mind that if someone is very committed and is able to decompile your Android app and man-in-the-middle your app's connection, they can still break your security. (I wouldn't worry about such special cases unless you are trying to protect a really high value target.)
For a basic level of protection:
- Only allow SSL connections, and require "Strict-Transport-Security"
- Use a shared secret that will be validated on the server (e.g. predefined api key, pre-installed client cert, etc.)
- Throttle API calls on the server
- Ensure that your API does not suffer from other common security pitfalls (use the OWASP Checklist: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet)
For increased security, you will need to implement some kind of pre-authentication, similar to the flow I describe here:
- The client asks for an access token from the server.
- The token is unique to the client and generated using the client IP, request time, and the shared secret. It's also short-lived and set to expire soon.
- The client makes the API call using the unique token while it's still alive.
- The server validates the token, confirms it's coming from the authorized client and processes the API call.
This topic is more complex and unfortunately I haven't come across a simple example that I can point you to.