App\Lib\Random\RandomString::generateAppKey() inserts dashes into the generated string, but it would probably be better for the dashes to be UI elements that are ignored in the actual token. eg: The UI (or maybe the Message Template processor) should insert dashes as needed, and then validation code should remove them when present.

Alternately, generateAppKey might continue to generate dashes (since application keys are generally copy/pasted) but a different function (eg: generateConfirmationCode) would generate a token without dashes for other purposes (eg: Email Confirmation).