org-crypt-key is the GPG key identifier, normally an email address.
Your GPG secret key resides in the secret ring in your
.gnupg directory, and is protected by your passphrase.
From the source code comments:
;; 2. Set the encryption key to use in the `org-crypt-key' variable,
;; or use `M-x org-set-property' to set the property CRYPTKEY to
;; any address in your public keyring. The text of the entry (but
;; not its properties or headline) will be encrypted for this user.
;; For them to read it, the corresponding secret key must be
;; located in the secret key ring of the account where you try to
;; decrypt it. This makes it possible to leave secure notes that
;; only the intended recipient can read in a shared-org-mode-files
;; If the key is not set, org-crypt will default to symmetric encryption.