Every request, importable.

// Pre-request script · runs before every request in this folder
// Environment: app-android. Rebuilds the app's signature and token.

// 1. timestamp the app includes in each signed request
const ts = String(Math.floor(Date.now() / 1000));
pm.environment.set("ts", ts);

const method = pm.request.method;
const path   = pm.request.url.getPath();
const body   = pm.request.body ? pm.request.body.raw : "";

// 2. refresh the access token before it expires
const token = pm.environment.get("access_token");
const expiresAt = pm.environment.get("token_expires_at");
if (!token || Date.now() > Number(expiresAt)) {
  const res = pm.sendRequest({
    url: pm.environment.get("base_url") + "/oauth/token",
    method: "POST",
    header: { "Content-Type": "application/json",
              "X-App-Key": pm.environment.get("app_key") },
    body: { mode: "raw", raw: JSON.stringify({
      grant_type: "password",
      username: pm.environment.get("user"),
      password: pm.environment.get("pass") }) },
  });
  const data = res.json();
  pm.environment.set("access_token", data.access_token);
  pm.environment.set("token_expires_at", String(Date.now() + data.expires_in * 1000));
}

// 3. sign the request and attach the headers the app sends
const msg = `${method}\n${path}\n${body}\n${pm.environment.get("ts")}`;
const sig = CryptoJS.HmacSHA256(msg, pm.environment.get("secret")).toString();

pm.request.headers.upsert({ key: "X-Timestamp", value: pm.environment.get("ts") });
pm.request.headers.upsert({ key: "X-Signature", value: sig });
pm.request.headers.upsert({ key: "Authorization", value: "Bearer " + pm.environment.get("access_token") });