rand or random is not cryptographically secure and must not generate keys or tokens.
Use a CSPRNG such as getrandom or RAND_bytes for security-sensitive values.