@rawsly - This official PHP package for HS is my go to… GitHub - HubSpot/hubspot-php: HubSpot PHP API Client · GitHub
I use this composer package in my Laravel apps and accomplish just this by setting the API key in a .env file.
Laravel also ships with CSRF protection which means the postman requests should be invalidated if the request wasn’t generated from your server with the session signed token. Since postman can’t generate those CSRF tokens, you might try that approach.
And yes, CSRF should work seamlessly with your react front-end… I use them in vue all the time, as long as the form is sitting on the same server that is generating the token 
If this answer helped, please, mark as solved
tim@belch.io | forms.belch.io | Design your own Beautiful HubSpot Forms; No coding necessary.
Drop by and say Hi to me on slack.