You can understand the api_key as your password that ensures that only you can execute the endpoints. Therefore, "decide what api_key you require..." means that you have to choose a string as a password. It should be safe enough of course...