I'm not sure which of these I need – a push certificate or an API key. They appear to do the same thing, but I'm not sure what the difference is, or even where to find them.
If you're developing an iOS app, you need to provide ExactTarget with a push certificate. ET signs your push message with this certificate so your app knows it's valid when received.
An Google Cloud Messaging (GCM) API Key is for Android apps.
As a side note, make sure you use the SAME Code@ AppCenter app for both iOS and Android. You can always segment by Platform later when sending a push message. You can also do sends to both platforms at the same time this way.