Client-side code (even native apps) must be considered public. That means your API is also publicly discoverable.
A user ID is fine to use as a public key, but it must be paired with something private. Generally some sort of unique, crypographically-secure auth token is fine when combined with forced HTTPS connections.
