Passing a borrowed nonce through Postman fails

For remote apps (cURL, Postman, etc.), or when not using the browser, you should use an authentication plugin like Application Passwords instead of sending the cookies.

But if you’d rather send the cookies, then copy and send the WordPress logged-in cookie named wordpress_logged_in_<hash>. Example in cURL:

curl -H "X-WP-Nonce: <nonce>" -X POST https://example.com/wp-json/wp/v2/posts -d "Data here" -b wordpress_logged_in_<hash>=<cookie value>

Note that WordPress saves the user’s login data (username and hashed data) in a cookie named wordpress_logged_in_<hash> (but you can change it using the LOGGED_IN_COOKIE constant).

Also, in the above (cURL) example, I used the X-WP-Nonce header to send the cookie nonce.

UPDATE: Added a screenshot for (locating and copying) the cookie in Chrome: