acme.sh

The dns_dnsmint plugin takes the API key and nothing else. It ships with acme.sh from the release noted below; until then, drop dns_dnsmint.sh into ~/.acme.sh/dnsapi/.

$ export DNSMINT_API_KEY=$DNSMINT_KEY

acme.sh --issue --dns dns_dnsmint \
    -d q7k4m2.a3f9c1-d4e7b8.dev -d '*.q7k4m2.a3f9c1-d4e7b8.dev'

acme.sh saves the key after the first run, so renewals need no environment at all.

Every recipe is verified against the client's current release. The other integrations cover the rest, and the quickstart goes from a bare address to HTTPS without any of them.