A "security key" is a physical item, so I am not sure how you forgot it. Did you mean you lost it?
Do you instead mean a recovery key? The information below is based on Apple's support article: Set up a recovery key for your Apple Account - Apple Support with quoted excerpts. Each section outlines the different situations and the strategies that may relate to use of a recovery key. If you are not familiar with trusted devices and numbers, see this support article —> Two-factor authentication for Apple Account - Apple Support
- If you still have access to your Apple ID and password but have lost your recovery key:
"You can generate a new recovery key from Settings or System Preferences on a trusted device." Refer to the steps in Set up a recovery key for your Apple Account - Apple Support about how to do this on different types of equipment (Apple equipment only).
- If you have forgotten your Apple ID password, have lost your recovery key, but still have access to a trusted device.
"you can try to regain access using your trusted device protected by a passcode." The process is outlined in this support article: If you forgot your Apple Account password - Apple Support This does not involve using a recovery key.
- If you have a forgotten password and you do not have access to a trusted device:
"you can use your recovery key, a trusted phone number, and an Apple device to reset your password."
- If you have lost your recovery key and have lost access to both your account and trusted items:
A recovery key is designed as an alternative to Account Recovery ( How to use account recovery when you can’t reset your Apple Account password - Apple Support ) which is where Apple helps you regain access to your account. However, "when you generate a recovery key, you can't use account recovery." You can try to contact Apple (see: Contact Apple for support and service - Apple Support ), but to me the previous statement implies that setting up a recovery key excludes Apple from being able to do anything. Apple says: "Using a recovery key is more secure, but it means that you’re responsible for maintaining access to your trusted devices and your recovery key. If you lose both of these items, you could be locked out of your account permanently."
