There is no single Salesforce API key. What you need is a pair, a Consumer Key and a Consumer Secret, issued by an external client app you create in Setup with OAuth turned on. A Salesforce user then allows that app, and only then can your code call the API.
The steps above come from Salesforce's own pages, among them the Trailhead API basics module and Salesforce Help on external client apps, with the day we last checked them. Settings we could not confirm on a Salesforce page are left out.
Two steps that surprise people
You enter a Callback URL while the app is still being created, before you have the key. And Salesforce may email you a code before it shows the Consumer Secret.
Why an app with the right scopes still fails
Scopes and user permissions are separate checks, and both have to pass. The scope lets the app call the API. The API Enabled permission lets the user who allows the app do the same.
The edition is the third check. If your org's edition does not include API access, no amount of setup gets around it, so look at the editions first.
The pair alone reads nothing. Once a user allows the app, Salesforce issues a short-lived access token that each call carries, and a refresh token if the app asked for the refresh_token scope. Keep the Consumer Secret and the refresh token in a secrets manager, never in code or a chat; the Consumer Key only identifies the app.
What to do next
For your own script, size your calls against the org's daily API allocation by edition before the first job runs. For writes, decide between upsert and update first.
To connect Salesforce to Oneprofile you need no key at all: sign in to Salesforce and allow access, and access stays current on its own. Choose a sandbox, or enter your My Domain, first if your org needs it.