In order to submit a query against QlikSense with Xrfkey in Postman, please do the following
In Postman, add the ?Xrfkey querystring to the url. Then add a Header key X-Qlik-Xrfkey and the same value as the Xrfkey in the url. This needs to be a 16 character string. Where that value comes from? You can just generate one.
I based my solution on this Qlik Community post https://community.qlik.com/thread/215715