Posh-ACME

The PowerShell client, and the way to do this on Windows Server. The DNSMint plugin takes the API key as a SecureString and nothing else. It ships with Posh-ACME from the release noted below; until then, save DNSMint.ps1 to a folder of your own and point POSHACME_PLUGINS at it.

$env:POSHACME_PLUGINS = 'C:\posh-acme-plugins'

$pArgs = @{ DNSMintToken = (Read-Host 'API Key' -AsSecureString) }
New-PACertificate q7k4m2.a3f9c1-d4e7b8.dev,*.q7k4m2.a3f9c1-d4e7b8.dev `
    -Plugin DNSMint,DNSMint -PluginArgs $pArgs

Posh-ACME keeps the key with the order, encrypted, so Submit-Renewal takes no arguments. Windows PowerShell 5.1 is enough; nothing here needs PowerShell 7.