I’ve developed a server application using Spring Boot and an Android client app. The server provides several APIs for the Android application.

I need to verify on the server side if requests are called from my Android application when handling the requests. I want to handle only the requests called from the Android application that I deployed and I should block API calls made via commands like curl.

Since secret values can be identified through APK reverse engineering, I cannot use methods that include related API keys or encryption keys within the Android application.

Is this possible?
If yes, what method should be used?