[wraptile]

There's also certificate pinning which is done by basically every modern android app so you often need to modify apk to remove that. Httptoolkit has a good blog on the process: https://httptoolkit.com/blog/frida-certificate-pinning/

[jeroenhd]

With root access, Frida can patch applications in memory, so you don't need to mess with the APK file.

If root is not an option, injecting Frida into the APK will work (but that might break applications that verify signatures).