I was just replying to your email as well. Yes, what we're doing is legal. We are using API keys provided by altmetric.com themselves and there is no issue distributing them with the R package. We are also not the only ones using it. However, it would be worth noting that these keys are severely rate limited. Meaning that you cannot only make a small number of requests per day. Given that the keys ship with the package, this limit is shared by every single person that uses the package. So, for any serious and sustained research, it wont really work (unless you do a little bit each day).
It would be similar to one being able to read a few NY times articles a month for free. For a very casual reader this might be fine. But for a regular reader a paid subscription would be required. I hope this answers your question. Happy to discuss more.