What Postman needs
FCM HTTP v1 does not accept a static API key the way the deprecated legacy API did. Every request needs a fresh OAuth 2.0 access token in the Authorization header, so Postman alone cannot send a message — you need to generate that token first, outside of Postman, or build a pre-request script that does it.
Getting an access token for Postman
The standard approach is a short script (Node.js, Python, or similar) that signs a JWT with your Firebase service account's private key and exchanges it at Google's OAuth token endpoint for a bearer token, which is valid for about an hour. That token is then pasted into Postman's Authorization tab as a Bearer Token for each test session.
The Postman request
With a valid access token, the request itself is straightforward: a POST to https://fcm.googleapis.com/v1/projects/PROJECT_ID/messages:send, Content-Type: application/json, and a JSON body with a top-level message object containing the device token and a notification or data block.
A faster option
If you just need to confirm a notification reaches a device rather than build a full Postman collection, the FCM notification tester does the JWT signing and token exchange for you directly in the browser from the service account JSON file, skipping the token-refresh step entirely.