Under the constraints that the user only has access to a release (signed) build of the android app and doesn't know the signing key. No rooted phone either. The token isn't sent through insecure channels (like http). User only uses default https certificates. The token is not exposed in any way through the user interface.
I am almost sure it is impossible (or at least very very hard), but I want to be sure asking you guys
If at any point you send data to a device the user physically possesses, they can extract it. (This is why DRM doesn't work.) If you want to start asking questions about "how hard" this is, the answer is that it should be super easy, and the degree to which it is not is the degree to which the device fails to meet the definition of a general-purpose computer. If you wouldn't do what you're doing in your app as part of an ordinary program intended to run on an ordinary computer, don't do it just because it's on a phone.
If you'd like a more detailed assessment of "how hard" extraction of this specific auth token from your app is, let's run an experiment: send me the APK, and if I can find out the token you pay me $100. If that sounds like a bad idea, ask yourself how you intend to make sure that no one with threatening levels of skill and curiosity ever gets ahold of your app.
