TSIG key

tsig-keygen ddns-key > /etc/bind/ddns.key

This generates a TSIG key using the default hmac-sha256 algorithm and writes it in the correct format: Example output in /etc/bind/ddns.key:

key "ddns-key" {
   algorithm hmac-sha256;
   secret "3RmJqR/YvLzKHZT7kVrLMQ==";
};

On the BIND server, include the key file in /etc/bind/named.conf:
include "/etc/bind/ddns.key";
Also add in /etc/bind/named.conf.local:
allow-update { key ddns-key; };

On the laptop, copy the ddns-key into /etc/bind/ddns.key