There are some items we need to consider when accessing APIs which are authenticated and authorized:
1- Remember Me - User log in once with Remember Me does not need to log in again.
Suggestion: SharedPreference for storing username & password (encrypted).

2- Access Token (JWT) - After user logins, server returns token for accessing API. Token must be sent along with request.
- Send token along with request - Retrofit - Token Authentication - Token expired: How to handle it? .

Reference

JWT - https://jwt.io/introduction/