How do you obtain a security key in Star Wars: The Old Republic?

There are three options:

• Buy the Collector's Edition which comes with a hardware key
• Buy a hardware key after the fact. It costs a couple bucks plus shipping. (Presently, $4 USD + shipping.)
• Download the free iPhone app or Android app.

Once you register a security key, the login prompt may still say it's optional, but no longer is at that point. Once a security key is registered, it must be used for all future logins.

Both types of keys display a 8 digit number that you type in yourself into the appropriate field in launcher login. It does not require any kind of USB connection or anything.

It is either a physical device (fits on a keychain, etc.) or an app on your mobile device. So it isn't really "moved between" computers; just carried by you. Depending how heavy your mobile device is, and how weak your biceps are, it still shouldn't be much of a problem. :)

Once you login with a registered security key, you will then get access to the in-game security key vendor. Mostly it offers the ability to purchase with in-game credits some, but not all, of the items that come with Collector's or Digital Deluxe editions. See the short list here. "Some examples of the items are the (popular so far) fleet pass which allows you to return to the fleet, a mouse droid (different skin from the Collector’s Edition item), Exchange Bandit (Increase movement speed by 110% Requires: Speeder Piloting Rank 3) and more."

Also see the official site page describing the security keys.

First, let me point out that the security key is a physical thing, not an in-game item. It must be purchased (see Mufasa's answer for sources) or installed.

The "security key" is an electronic security token (usually a keyfob), a self-contained, battery-powered device with a numeric display that will generate a new, cryptographically secure pseudorandom number every minute or so. They're meant to be portable, though they are a bit bulkier than a typical key:

"Cryptographically secure" means that, unlike a normal PRNG where given enough "random" numbers, an attacker could quickly predict the next by determining the state of the generator, the number is run through an additional series of steps that effectively hide the state of the machine.