Key used by HMAC-SHAx in PBKDF2 PBKDF2 can be used to derive a key from a passphrase, having in input the passphrase, the chosen number of iterations to slow down a brute force attack, a random salt and the chosen keylength. In its implementation it needs a PRNG which can be, for example, HMAC-SHA-something; but HMAC needs itself a key together with a "message" (which I think is the passphrase in the first iteration, and then its resulting hash in the subsequent ones): so what is this key?
The key is the password.

For the first iteration, the salt concatenated with the desired output length in bytes is the input.
U1 = PRF(Password, Salt || INT_32_BE(i))

For subsequent iterations, the HMAC result is the salt.
U2 = PRF(Password, U1)
...
Uc = PRF(Password, Uc-1)