The best practice is to not store the access credentials within the program. Apps do not always contain (unless they are badly designed) any specific credentials within themselves to access the API.
While adding credentials into the code may deter general attackers it will not stop attackers who can open up the package and extract the details. As something that can be cracked by a few is considered vulnerable too the right way to implement it would be as follows.
- Add not credentials into the APP
- When the APP is installed generate credentials and register with the server. (could be username and password or could be a client side certificate)
- Obtain an access token using these credentials.
- Use the access token to access the API
As you can efficiently control the registration process and can permit access to secure parts of the API based on the access token your implementation should be secure enough if you use SSL/TLS for them.