We study communication-constrained secret key generation, where two legitimate parties would like to generate a secret key using communication subject to a rate constraint. The problem is studied in the finite-blocklength regime. In this regime, the use of auxiliary random variables subject to Markov chain conditions in the corresponding asymptotic bounds has proven to make most existing proof techniques insufficient. However, two recently proposed proof techniques - one for the achievability side based on Poisson matching, and another for the converse side based on reverse hypercontractivity - allow us to overcome these issues to some extent. Based on these techniques, novel one-shot and second-order achievability and converse bounds are derived for the problem. While the second-order bounds do not coincide, leaving a precise second-order characterization of the problem an open issue, they improve upon the previously known tightest bounds. The second-order bounds are demonstrated for two simple sources: the binary symmetric source and the Gaussian symmetric source. For the binary source, we find that the gap between the two bounds is mainly due to an unwanted constant in the converse bound, and the non-convexity of the achievability bound.