First, you need to get auth_token using auth.gettoken method and pass it to your service to perform the task.

That's, your service should accept the token and return it to Elgg with a new task.

Perhaps more details about what you're doing will help clarify the situation better.

There is no need to add auth_token because I set  the following two parameters to false

'require_api_auth' => false,

'require_user_auth' => false,

"I would like to test the service by sending a JSON payload via a POST request using Postman."

Sending the requests to Elgg you should not send JSON.

In Postman set the POST body to x-www-form-urlencoded and the params as the api call requires.

In response you'll get a JSON, but you can't do that in the request.

It should be on '/settings/user/USERNAME' page under 'Configure your tools' section.

Thanks Nicolai, knowing what I should expect helped a lot.  The docs dont seem to mention all this either: 

The docs make it seem all auto-magical and unclear, somewhere it implied you dont need any kind of action handler, like the plugin setting, another place it implies there should be an action/plugin/handler. What a mess.... This section of the docs could really use some improvement.