plugin wants an API key, what is that exactly?

Small add: if the service gives you two keys, a public one and a secret one, the secret one never goes anywhere public. Most dashboards also let you restrict a key to your domain, worth doing so a leaked key is useless to anyone else.

Basically a password your site uses to talk to another service, so it knows the requests come from your account. Copy it from that service's dashboard, paste it in, and keep it private.