INVALID_SESSION_ID for custom Rest Api(public) when i call from sanbox

@RestResource(urlMapping='/v1/MyApi/*')
global class test_publicapi {
 @httppost
    global static void login(string email,string password)
    {        
        RestRequest req=RestContext.request;
        restresponse res=restcontext.response; 
        req.addHeader('Access-Control-Allow-Origin', '*');
         res.addHeader('Access-Control-Allow-Origin', '*');           
        req.addHeader('Access-Control-Allow-Headers', 'session_id');
        res.addHeader('Access-Control-Allow-Headers', 'session_id');
        req.addHeader('Access-Control-Expose-Headers', 'session_id');
        res.addHeader('Access-Control-Expose-Headers', 'session_id');
        string pwd; 
        boolean valid;
        JSONGenerator r=JSON.createGenerator(true);
        try{
             r.writeStartObject();
             r.writeStringField('status','success');
             r.writeEndObject();
        }
        catch(Exception e)
        {
            r.writeStartObject();
            r.writeStringField('status','error');
            r.writeStringField('message',e.getMessage());
            r.writeEndObject();
            res.responseBody=blob.valueof(r.getAsString());
        }
    }
}

When calling this sanbox  api from posman , it is not working and give me an 401 error. but it works for prodction api