I want a public DNS with an API that lets me scope the token to a single record. 🤔

So I can have a token that allows a client to modify just _acme-challenge.
Or some-service.