This sounds great, although I haven't tried it myself. I have a few domains where I want/need wildcard certs and even though my registrar has API access, it's basically a god mode token that can do anything my logged in account can.

So my only choices are, take the risk and save that API token on my server, or just manually run a script that renews the certs on my own computer every three months.

If this works, we can create a new account on the registrar with just the one (not so important) domain, and create an API token for only that account.

However, it still doesn't seem like a perfect solution to me. For example, if that API token does get leaked, someone else could still create a certificate for your domain. But I guess that's still a lot better than using your token to transfer the domain to another person.

It would be great if registrars provided more fine grained control over the access an API token is granted.