I'm creating HTTP REST service which will be available over tls only.

For authentication purposes I plan to generate JWT token for every user using HMAC HS256. I need a secret key for HMAC.

What are the requirements for secret key?

Do I need a long string of random characters? Or fixed-length string? Or what?

I've added my answer here as I feel the existing ones don't directly address your question enough for my liking.
Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you intend to use - em mine):

Block size:  the size of the data block the underlying hash algorithm
operates upon.  For SHA-256, this is 512 bits, for SHA-384 and
SHA-512, this is 1024 bits.
Output length:  the size of the hash value produced by the
underlying
hash algorithm.  For SHA-256, this is 256 bits, for SHA-384 this
is 384 bits, and for SHA-512, this is 512 bits.

As WhiteWinterWolf notes, longer than B (block size) is discouraged because the value must be hashed using SHA-256 first (i.e. 512 bits in this case) and less than L (output length) is discouraged (256 bits in this case). However, a 256 bit key is overkill as anything that is 128bits or greater cannot be brute forced in anyone's current lifetime, even if every computer in the world was working on cracking it.
Therefore I'd recommend a 128 bit key, generated with a cryptographically secure pseudo random number generator (CSPRNG). If you want to store this as text then a 128 bit key can be represented by generating a random 32 character length hex string, or alternatively you could generate 16 random bytes and then run them through a base64 function.
