The Google Cloud Platform also has keys. If you go into the Developer's Console and create a service account [1] you can tell gcloud about that file [2] and it will use it instead of doing the web flow.
And, as bradabrams notes below, the --no-launch-browser option works if you want user credentials on a headless machine.
(I wrote the 'gcloud auth' commands, so if you have a suggestion for how to make this clear, reply and it will go to the right person).
Thanks for the heads-up. Admittedly, I was a little frustrated at the whole thing and didn't take the time to do a deep dive on the docs for a simpler approach. I'm not sure if there's a better way to try and detect what's going on to proactively give the user a notice. Your comments seem like they'll make this a non-issue on boxes I haven't authenticated on yet, though, so that's good.