A wildcard certificate can only be issued through the DNS challenge, which means whatever renews it can write records in your zone — and the default API token most providers hand out can write all of them.
# the credentials file, mode 600, root-owned
# /etc/letsencrypt/cloudflare.ini
dns_cloudflare_api_token = ... # Zone:DNS:Edit on ONE zone
certbot certonly
--dns-cloudflare
--dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
--dns-cloudflare-propagation-seconds 30
-d 'example.com' -d '*.example.com'A global API key on that file makes the web server able to repoint the MX record, which is a considerably larger blast radius than the certificate it exists to renew. Scoped tokens have been available for a while and there is no reason not to use one. The propagation delay matters more than it looks — the default is often too short for a provider with slow secondaries, and the failure is an intermittent renewal that succeeds when run by hand.