I have a package which deploy some functionality to organization and to be completely installed I need to add custom button to quote layout. As I know - there is no way to add custom button from Apex, but we can do it calling metadata API. And here is another problem I can call metadata API from trusted IP address or I should use security token. Obviously, I do not have security token at package installation time and the only way - add IP address to trusted. Is there unobtrusive way I can do that during installation?
If the user installing the application has API access then you can certainly call Metadata API provided you create Remote site settings.
The visualforce merge field or userinfo.getsessionId() can be used to extract session Id .
The first step can be creation of Remotesitesettings followed by API callout .
You can also Use pure JS Ajax callout to invoke Metadata API if you do not want to use apex metadata API wrapper.