This question already has an answer here:
I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and installed root certificates on his device and got my Web API.
So, Please give me advice how i can protect my WebAPI.