I don’t use Postman but the answers above should cover all the pitfalls. The only one I didn’t see was that you have to be calling Companies House from somewhere you’ve informed them about first when registering your app. So either an IP you registered with them (for use on a local server / locahost search the forum for the workaround for this) OR (for javascript / from browser) a hostname you’ve registered with them.
The response means what it says I think - the issue is in the header so the key or the format of the Authorization header aren’t to Companies House’s liking.
Double-check your API key as well, several people have gone a long way then found they weren’t using the key they thought they needed e.g. they’d an old key, or had the non-live key, or extra spaces…
I’d ensure that you’re ONLY sending the Authorization header (you don’t need things like Content-type, Accepts etc. for this request).
Apparently there are some ways to check what you’re actually sending in Postman. See here:
… and check that the value it’s actually sending in the header is per the standards e.g. see here (lots and lots of examples on this site also).
Finally it’s sometimes helpful to try another tool e.g. curl if you’ve got access to that (from your registered server) - it’s really simple and you can turn on a very verbose mode to inspect traffic.
Good luck.