Unauthorized 401 for dns-01 acme challenge on hetzner

[hasufell]

I have the following configuration:

tls {
    loader acme {
        email "[email protected]"
        agreed
        challenge "dns-01"
        hostname "foo.de"
        dns hetzner {
       	    api_token "..."
        }
    }
}

I made sure that:

• the API token on hetzner is for the correct project
• the API token is read&write
• the DNS nameservers are exactly as described by the hetzner documentation (helium.ns.hetzner.de., hydrogen.ns.hetzner.com., oxygen.ns.hetzner.com.)

However, I constantly get these errors:

tls.loader.acme/acme_client: trying to solve challenge	{"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","challenge_type":"dns-01","identifier":"foo.de"}
tls.loader.acme/acme_client: cleaning up solver	{"challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.foo.de\" (usually OK if presenting also failed)","identifier":"foo.de"}
tls.loader.acme/obtain: could not get certificate from issuer	{"error":"[foo.de] solving challenges: presenting for challenge: adding temporary record for zone \"foo.de.\": Unauthorized (401) (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/<removed>) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","identifier":"foo.de","issuer":"acme-v02.api.letsencrypt.org-directory"}

I also manually tested the API token against the hetzner API. It works.