i'm trying to make another security layer above the 2FA layer for super admin panel/login
what i have in mind so far is a shared key (shared seed) to generate random guids that is created by client-server communication (c# client, asp.net core server api), the client/server communicate to get the number of the random number sequence (both have a private shared key), so they both can generate same guid that the admin can then use to login to his panel (which then he use 2FA to login)
assume that this shared key is dynamic, and no one else has access to this tool but the admin (used to generate the shared key) then would it be secure ?
(will limit the usage of this login page to one time in less than 5 mins), is that safe enough? any loop holes i can't see?
also assume that server api / client communications are secured with one time pad password that is encrypted inside the client with another one time pad, and the random generator isn't linear and isn't easy to predict (not like linear PRNG)