You can make a Cloudflare API token that allows editing all DNS records for a specific zone, but I don't see a way to make a token that is restricted to updatin

You can make a Cloudflare API token that allows editing all DNS records for a specific zone, but I don't see a way to make a token that is restricted to updating a specific record. Setting up a subdomain as a separate zone within Cloudflare is only available to Enterprise customers. But yes you could register a separate challenge domain for the trick described in this article, add it to Cloudflare, and then use a token scoped to only that challenge domain, and it'd be a reasonably safe thing to do.