The reason your script isn’t working is because the first parameter of the OnServerEvent callback is the player who called the event, so your callback parameters should be (player, key, money) instead of (key, money).
Also, you should never have a designated remote to change player’s stats as it’s highly exploitable and your key being a constant string won’t stop anyone from hooking onto a remotecall to figure that out.
To actually make a secure remote to edit player stats, you’d want to have separate remotes (or functions & denote it via an argument) ones for the instances in which that they’d be edited i.e when a player buys something, the player would fire a RemoteEvent with what they wanted to buy and on the server you’d check to see if they have enough money and if they do, you can edit their money and give them the tool but if they don’t, you can also check for that on the client and then you’d know that they’d be exploiting because the only time the remote can be fired on the client is when that if-statement is valid so they had to have called it from an external environment.
For more information regarding how exploits work, you should check out this thread; I think it’d help you greatly: Exploiting Explained