Just as a heads up, if you generate this random code on a page-level workflow, it will be visible to the user if they inspect the page! You can argue that people generally won’t know how to, but its the tech-savvy people who can/will exploit all your app’s vulnerabilities. It would be advisable to create a backend API workflow which generates the code and sends the email. Trigger the backend workflow from the page so that the code is generated on the server rather than on the client.
This could get you on the right direction. The trick is using multiple elements instead of trying to do everything on one.