If it's running only on devices that are fully in your control, the solution is easy: make the app authenticate with your API using a large, cryptographically secure-random secret key [1].
But if it's the latter, what you're asking for is generally not possible. A competent actor can reverse-engineer your app to extract any API keys or secrets or other tokens that you'd embed it your app, and thereby masquerade as your app [2]. But, as with nearly everything, it's a trade-off. Obfuscating your secret may cut down on the amount of casual requests to your endpoints, but treat this as a developer convenience, and not as a security mechanism.
[1] https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Au...
[2] https://rammic.github.io/2015/07/28/hiding-secrets-in-androi...