The bits are defined in RFC 5280 §4.2.1.3: digitalSignature (TLS handshake signatures, OCSP), contentCommitment (formerly nonRepudiation, for documents meant as commitments), keyEncipherment (RSA key transport, no longer used by TLS 1.3), dataEncipherment, keyAgreement (ECDH), keyCertSign and cRLSign (CA certificates). CA certificates must mark the extension critical.
Typical leaf values: ECDSA TLS certificates use digitalSignature only; RSA TLS certificates use digitalSignature and, for TLS 1.2 RSA key exchange, keyEncipherment. Verifiers that enforce the bits reject mismatches, so a certificate issued for signing cannot be used for key agreement and vice versa.
Key usage restricts cryptographic operations; extended key usage (EKU) restricts applications such as server authentication or code signing. Both must allow the use for a verifier to accept it.