1. Your main domain is important.example.com with provider A. No DNS API token for security.

2. Your throwaway domain in a dedicated account with DNS API is example.net with provider B and a DNS API token in your ACME client

3. You create

_acme-challenge.important.example.com not as TXT via API but permanent as CNAME to

_acme-challenge.example.net or

_acme-challenge.important.example.com.example.net

4. Your ACME client writes the challenge responses for important.example.com into a TXT at the unimportant _acme-challenge.example.net and has only API access to provider B. If this gets hacked and example.net lost you change the CNAMES and use a new domain whatever.tld as CNAME target.

acme.sh supports this (see https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...; this also works for wildcards as described there), most ACME clients do.

I also wrote an acme.sh Ansible role supporting this: https://github.com/foundata/ansible-collection-acmesh/tree/m.... Example values:

  [...]

  # certificate: "foo.example.com" with an additional "bar.example.com" SAN

  - domains:

    - name: "foo.example.com"

      challenge:  # parameters depend on type

        type: "dns"

        dns_provider: "dns_hetzner"

        # CNAME _acme-challenge.foo.example.com => _acme-challenge.foo.example.com.example.net

        challenge_alias: "foo.example.com.example.net"

    - name: "bar.example.com"

      challenge:

        type: "dns"

        dns_provider: "dns_inwx"

        # CNAME _acme-challenge.bar.example.com => _acme-challenge.example.net

        challenge_alias: "example.net"

  [...]