Storing REST api secure key on client side Android

Question

Is it best practice to put "secure key" as part of the android code and generate apk for distribution. I make some rest calls inside my app, where "secret key" to call external services are passed as part of the HTTP headers.Is that a good practice? Will there be a chance of running my apk for eg on emulator and intercept rest calls,there by gaining access to the secret key am passing?