As mentioned in the documentation and Google's checklist for SafetyNet Attestation integration, it is now mandatory to use an API key to use the SafetyNet Attestation API.

Previously, it was possible to use the SafetyNet Attestation API without an API key, and you would get a default quota (not specifically assigned to your project). This default quota is now deprecated.

The usage of the shared quota unnecessarily exposed your traffic to project-specific throttling and may have caused errors for other users of the API.

Around April 2018, Google started blocking new users of the SafetyNet Attestation API (as identified by the application's package name) from using this default quota.

Most existing clients now use API keys, but if your project doesn't, all unauthorized traffic without an API key started failing permanently from August 1, 2018.

If you were using the SafetyNet Attestation API without a key, you must now use a key. The good news is that doing so is free, and it's very easy!