Why does AES-GCM not require an auth key, but encrypt-then-mac does?
AES-GCM does require an authentication key. You don't need to pass it because it is generated from the encryption key by encrypting an all-zero "plaintext" block:


  The hash subkey, denoted $H$, is generated by applying the block cipher to the “zero” block. The
  resulting instance of this hash function, denoted $GHASH_H$, is used to compress an encoding of
  the AAD and the ciphertext into a single block, which is then encrypted to produce the
  authentication tag.


(source - in "5.3 Primitives for Confidentiality and Authentication")