What is the correct way of logging in through services from android?
You can use Android AccountManager over https to be more secure.
Like this Drupal 8 Android app at https://github.com/onedrupal/One-Drupal-Android.