The cluster, navigation and speed-camera alerts are free. Next to the car all you need is the Bluetooth key — the virtual key isn't used by the free plan at all.
Connected (US$3.99/month or US$39.99/year) adds status while the car is far away, Car Checkup (battery health, tires), Vehicle Controls, After-blow, the turn-signal display, and unlimited destination sync both ways.
Before payment the subscription screen checks three things — ① Tesla sign-in ② confirm your car ③ virtual key pairing (in the Tesla app). Step ② isn't a choice: the app checks by itself that the car appears in the account you signed in with. Subscribe unlocks once the first two are done. If the car belongs to another account (a company account, or a family member's account where you're only an additional driver), Connected can't be set up from yours, so the app tells you before payment and asks you to sign in with the account the car is registered to.
The virtual key is added once in the Tesla app, because Tesla requires it to send status when the car is far away. Turn on all four permissions — vehicle data, vehicle location, vehicle commands, charging management. Miss one and only that feature quietly stops.
Car Checkup can still be opened once on the free plan. You can cancel any time in iOS Settings → your name → Subscriptions.
If the virtual-key screen appears after payment and you're not at the car, tap “I'll do this at the car — go to the cluster for now”. You go to the cluster this time, and the app asks again next launch. Connected features such as remote status stay paused until the virtual key is added.