A key obtaining method includes sending, by an authentication server function (AUSF), an authentication service request message to a unified data management (UDM) function. The method also includes receiving, by the AUSF, an authentication service response message sent by the UDM function. The authentication service response message includes first permission information. The first permission information is used to indicate to generate a key KAKMA for user equipment (UE). The method further includes generating, by the AUSF in response to the authentication service response message, the KAKMA and a key identifier (KID) corresponding to the KAKMA. The method additionally includes sending, by the AUSF, the generated KAKMA and the generated KID to an authentication and key management for applications anchor function.