https://docs.opnsense.org/manual/dynamic_dns.html says under "provider specific info" that one should leave the username blank for he.net and only put the generated key into the password field.
If you try that with current 21.7.7 you will notice that the form will not allow you to save as it insists on the username.
I got it working with the custom option, just wanted to let you know about the inconsistency between the form itself and the documentation. Should be fixed for both he.net and he.net (v6) as both work the same way.