the Recaptcha's Site key and Secret key need to be input on the Site Settings > Form spam protection tab (follow the steps in the 'Setup Google Recaptcha' section) which will appear in Site Settings once Webform functionality is enabled.
Note: you will need a Google account to complete the reCAPTCHA setup. If you do not have one, you can create one during the setup process.
Go to Site Settings > Form spam protection tab
Click the ‘Google Recaptcha’ link - it's helpful to open the Google reCAPTCHA pages in a new browser tab as you'll need to switch back to the Site Settings during the setup process
On the Google reCAPTCHA page, click the 'My reCAPTCHA' button in the top-right of the screen. By clicking on the button, you'll be prompted to login using your Google account. If you do not have a Google account, you can create one at this point
Once you have logged in, create a new reCAPTCHA in the 'Register a new site' section:
Google reCAPTCHA registration options
Add an optional Label to identify your reCAPTCHA
Choose 'reCAPTCHA v2' > 'Checkbox'
In the 'Domains' field, add each of your site's domain(s) - one per line
Accept the Terms of Service
Under the 'Keys' section of the next page of the reCAPTCHA setup, copy and paste the 'Site key' and 'Secret key' (see below) into the 'Recaptcha site key' and 'Recaptcha secret key' fields in the Site Settings > Form spam protection tab
Recaptcha keys (mocked up) on the Google reCAPTCHA setup page