Wireless body area networks composed of wearable devices have increasingly become an integral part of personal health monitoring and medical assistance. A series of key agreement schemes using heartbeats as a source of trust have been proposed to protect health data transferred among devices carried by a person from leakage. However, because of the unrealistic assumption in their threat model and the use of fixed parameters, previous schemes have unstable performance for different individuals and even have the risk of security degradation such that the schemes can be compromised by attackers. In this paper, we present an optimal key agreement scheme based on heartbeat, to ensure secure communication between legitimate devices. The proposed key agreement scheme employs fuzzy commitment with low latency in feature extraction. Moreover, the physiological-distribution-based parameter optimization (PDPO) algorithm is proposed to adaptively determine the optimal protocol parameters for individuals, which not only ensures outstanding and stable performance but also guarantee the security of the scheme. Finally, we prototype our protocol and conduct experiments with multiple subjects to evaluate its security and performance. Our results demonstrate that the proposed protocol negotiates the key securely and quickly, has low energy overhead, and is suitable for practical applications.