So what worked for me is to run the right combination of gcloud auth login, gcloud auth application-default login, gcloud config set project and gcloud auth application-default set-quota-project commands. Oh, set GOOGLE_CLOUD_PROJECT, and of course unset GEMINI_API_KEY. Trivial.