Cloudflare Non-Global API key setup?

I tried to set up a connection between CyberPanel and Cloudflare today only to stop dead at the first instruction: set up a global API key.

Um, absolutely not. I will never give any service global access to my Cloudflare account.

If that’s the only way CyberPanel interacts with Cloudflare that’s a regrettable sidestep of best security practices as API access should be limited to specific accounts and actions.

But it’s possible CyberPanel’s documentation is behind and the panel will work with siloed, editable DNS Zone API keys (for instance) so I wonder if someone might share how they set up their key so I can issue a wildcard cert for the panel URL?

I tried:
Zone > DNS > Edit

Include > Specific Zone > MyDomainDotCom

No IP address filtering

No TTL

Thanks in advance!