You Need to set the rtFa and FedAuth cookies in the request when you use Postman or Fiddler for testing. You can get the cookie values in the browser console after successfully authenticating in another tab or window. The format for the Cookie header is FedAuth=[paste FedAuth cookie value here];rtFa=[paste rtFa cookie value here]
If you are creating a production app and it is calling the REST API from outside of SharePoint, you need to retrieve an access token and use it in the Authorization header. To retrieve the access token in this case, you are best off using ADAL. ADAL is available in many platforms and languages. Explaining how to use ADAL is out of the scope of this answer, but you can find many tutorials online.
If you are calling the REST API from inside of SharePoint via JavaScript, the browser will automatically include the cookie in the request.