In my scenario, I have an Android mobile application which calls my back end REST services. I want prevent other application to call my back end REST services. If I use certificate and shared key as well as obfuscating my application's code, attackers can beautifier my source code and do reverse engineering.
This is near impossible to achieve (short of white-listing IP addresses). Given someone has enough time and resources, they will almost certainly be able to send calls to your API outside of your client. In general, you want to assume attackers know everything about your API and design your API to be resilient to attacks (Ex. good authentication practices with correct limiting, etc.), otherwise, you would likely be fighting a losing battle.
A great example I like to bring up is the Pokemon Go API (link here). Hackers were quickly able to create 3rd party clients that would send erroneous location data and allow users to catch Pokemon from all over the world. Despite API updates, hackers continuously re-reversed engineered the necessary steps to send valid API calls.