Porkbun's API is POST-only with apikey + secretapikey carried in the request body. Zone lookup walks parent labels against /domain/listAll since Porkbun has no explicit "which zone covers this name" endpoint. TXT ops use the retrieveByNameType / editByNameType / deleteByNameType variants — editByNameType replaces every record at (subdomain, TXT) in one call, which matches the single-value _lexicon shape exactly. login pings /ping to verify the credentials and report the caller's whitelisted IP.