Sending password or as you said key in email is not the safe way. WordPress send a link in email when click on forgot password button.
When you click that link it redirects to a default WordPress page for reset password there you have enter and that’s it and this is the easiest way for the user.
Like you said you want to send a key in email it’s like OTP and user need to enter while login and again before expiration of that key user have to change their password so it’s double work for them. If you want to do it then you have to make your own custom code/plugin to perform this action in safe way and your website must have proper instructions for the users.
Hey,
I did some research. I found following plugin
https://wordpress.org/plugins/pie-register/
You have to install this plugin goto pie register-> Notification -> Select tab User notification-> select template from dropdown
“Password reset request”.
When you select this template it will give you to edit forgot password email in editor, where you can remove (%reset password url%) from there.
So in forgot password email url won’t come instead you can put your key but for dynamic key genration have to see further.
Hope this helps!
Prasad 🙂