Google API Client side usage - is the API Key mandatory?

I am using Google directions and geocode services in my iOS App, and it works fine. I am also using Google maps API.

For google maps, I am using an API Key, but for geocoding and directions services, I am calling them as any REST Webservice, without adding the API Key parameter, and it works.

My questions here are

Is the API Key mandatory for client-side calls ? Is it legal ?
If not, what are the risks?
If I add an API Key, the 2500 query per day per key limit will apply, or the limit will be per users IP address?

In https://developers.google.com/maps/documentation/directions/ I can read

All Directions API applications should use an API key

In https://developers.google.com/maps/documentation/geocoding/ I can read

All Geocoding API applications should use an API key

At the same time, I am not using Server side Geocoding/Directions, but Client side calls, and for now, I haven't sent any ApiKey when using it.

Solution

A key is not required for these webservices, they may work without.

The difference is the quota: without a key it will be based on the IP-address of the server. When your domain shares the same IP-address with other domains(usually it's the case) you will also share your quota with these domains.

The result: when applications placed at other domains with the same IP(may be houndreds) also request these services(without a key) you'll often hit the limits.

When you use the services on clientside(via the methods of the maps-Javascript-API) it doesn't matter at all, any limit will apply to the user of your application, not to the application.