Do you have to buy security keys

If you are referring to physical security keys, yes they would have to be purchased.

FWIW, I have been using YubiKey keys, provided by Yubico, for a few years now and have had no issues with using them. Simple to set up and use. I use them with my Macs, PCs, & iPhone.

See especially “Choose the right security keys” in the article linked above.

Amazon is one possible source.