certbot

certbot needs no plugin. It hands the challenge to a hook script of yours, which is all our endpoints want. Write two, identical but for the last path segment, and make them executable.

#!/bin/sh
# /etc/letsencrypt/dnsmint-auth.sh   (chmod +x)
# Swap present for cleanup in the second copy.
exec curl -fsS -X POST https://dnsmint.com/api/httpreq/present \
    -H "Authorization: Bearer $DNSMINT_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"fqdn\":\"_acme-challenge.$CERTBOT_DOMAIN.\",\"value\":\"$CERTBOT_VALIDATION\"}"

Put the key carrying dns01:write in DNSMINT_KEY in the environment certbot runs under, then:

$ certbot certonly --manual --preferred-challenges dns \
    --manual-auth-hook /etc/letsencrypt/dnsmint-auth.sh \
    --manual-cleanup-hook /etc/letsencrypt/dnsmint-cleanup.sh \
    -d q7k4m2.a3f9c1-d4e7b8.dev -d '*.q7k4m2.a3f9c1-d4e7b8.dev'

CERTBOT_DOMAIN is never the wildcard form, so the hostname and its wildcard produce one challenge name and two values, which is what DNS-01 wants. This works the same whether certbot came from pip, a package manager, or snap.