We try our hardest not to treat Android like a second class citizen, but we have to fall back on sign-in tokens for any hint of security or identification. 

Luckily most of our API calls don't rely on Device identity (though it helps to have it). Right now we're passing in our current solution and just not using it for anything.