Yes, unfortunately both the client and server need to have that shared private key to generate the same codes. Transmitting the key over a 'secondary' channel

Yes, unfortunately both the client and server need to have that shared private key to generate the same codes. Transmitting the key over a 'secondary' channel would have protected people here. It begs the question of whether or not TOTP is really 2FA if it is setup using a single channel of communication.