I figured it out.

FinchVPN uses your email address and a password for account login, but when you set up your account you actually nominate a separate UserID which is what you have to use when you install the ovpn file in the router, along with the API Key as the password.

So there are two completely separate sets of credentials - one for account login and one for using the service in the router.

Obvious in retrospect, but perhaps a few extra words on this in the install guide might be helpful to others doing this for the first time.