In order to do something, we need to make call outs to an external server where the URL takes the format:
external-id would be specific to and stored in individual records and swapped out for each call.
api-key would normally be a "fixed" value, although it might (of course) occasionally be updated. And our production org would call a different server instance than our sandboxes (which may or may not share the test server) and (of course) this key would be different than production.
(In the medium/long run, we might change the API since putting the key in the URL doesn't seem like a great idea... but til then...)