lego

lego's built-in httpreq provider posts the challenge to an endpoint we serve, authenticated with your API key as the basic-auth password. No credential to mint and nothing to pre-seed: the endpoint, a username of any value, and the key carrying dns01:write for the hostname as the password. The username has to be set even though we ignore it: lego sends basic auth only when both variables are.

$ export HTTPREQ_ENDPOINT=https://dnsmint.com/api/httpreq
export HTTPREQ_USERNAME=dnsmint   # any value; lego sends auth only when both are set
export HTTPREQ_PASSWORD=$DNSMINT_KEY

lego run --email you@example.com --dns httpreq \
    --accept-tos -d q7k4m2.a3f9c1-d4e7b8.dev -d '*.q7k4m2.a3f9c1-d4e7b8.dev'

The acme-dns route still works if you prefer it; it needs the registration file written to lego's storage before the first run, as described in the API reference.