Would significantly limiting the endpoint without a key, but keeping it open for a quick test be an option?

Like, so that people can just hit your endpoint as a test, allow like 25 requests a day without a key, and then free tier with registration at 1500? That way you don't lose the instant "just try it" factor?

That being said, asking for a verified email address to use your free service is hardly questionable. Declare it for abuse management and ensuring you can be contacted if you do something weird with the endpoint, perhaps.

It's even fair to have a checkbox to get marketing email about your paid service, though I'd leave it unchecked by default if you want to be a good guy in today's society.

Oh, another reason I realized you should have registration/people's email: While you wouldn't want to automatically send these people marketing emails without their express interest, you WOULD want to be able to send your free tier users security notices.

I don't know which API you are at, but I use OpenWeatherMap, and usually, do so with a city ID to request the location. But you can query OpenWeatherMap by GPS (I don't, myself), and you could be querying it using precise coordinates. So if OpenWeatherMap were to have a security breach, my location history might be leaked, and I'd like to know that... even if I'm on the free tier.