If only this didn't require an API token with write access to the entire domain. Please Cloudflare, let us grant access to specific (or regexp!) records
Last I checked AWS has the same limitation. One workaround is creating a separate sub-zone and giving access only to that to whatever you need. But for a "cheap homelab" solution, that's gonna cost you a bit more per month.