ACME certificates (DNS-01)

Create an ACME-scoped token in the panel first. It can only add and remove _acme-challenge TXT records — even if leaked, it cannot touch your other records.

acme.sh

# 安装插件(一次)
curl -fsSL https://anyns.io/dl/dns_nht_install.sh | sh

# 签发(含泛域名)
export NHT_DNS_Token="nhtdns_xxxxxxxx"
acme.sh --issue --dns dns_nht -d example.com -d '*.example.com'

lego / Traefik / Caddy(httpreq)

export HTTPREQ_ENDPOINT="https://anyns.io/api/dns/acme"
export HTTPREQ_USERNAME="token"
export HTTPREQ_PASSWORD="nhtdns_xxxxxxxx"
lego --email [email protected] --dns httpreq -d example.com run

lego's httpreq is a generic shape: tools that support it (Traefik, Caddy plugins, …) need no dedicated plugin — just the three environment variables above.