...or interactively asking for password / or having some certificate is inevitable?

**Context**

My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my user with asking/registering passwords, neither asking to install certificates.

So here is a proposed solution, but I have serious doubts about it can not be faked.

**Proposed solution**

* The connection between the my Android App and my server API is constrained to HTTPS
* Before the App first communicates with the server it queries my App installation Id. All subsequent API call will have this unique id as first parameter.

**Question(s)**

Is it possible that any 3rd party (criminal, hacker) get know this installation id, (say installing an other malicious app on the very same device) so then can send fake requests to my server using any custom tool say a desktop app?