// The key comes from;

        $key = $this->app['config']['app.key'];

        if (Str::startsWith($key, 'base64:')) {
            $key = base64_decode(substr($key, 7));
        }

// Then with your first code, using key

$reset_token = hash_hmac('sha256', Str::random(40), $key);

// then stored, but hashed again

    DB::table('password_resets')->insert([
       'email' => $request->email,
        'token' => Hash::make($reset_token),
        'created_at' => Carbon::now(),
    ]);