Implementing two-factor authentication (2FA) with email-based authentication codes is indeed an additional security measure to protect your administration panel. However, it's important to carefully consider the pros and cons of this approach and implement it securely. Here's how you might implement the process you've described:

**1. Send an Email with Authentication Code:**

After the user enters their username and password, the system generates a random authentication code. This code is then sent to the user's registered email address. The email should include instructions on what the code is for and how to use it. The code should not be displayed in the email itself for security reasons.

**2. Authentication Code Expiry:**

You mentioned that the authentication code should expire within 5 minutes. This is a good security practice to ensure that even if the code is intercepted, it would have a limited window of usability. After the code expires, the user would need to request a new one if they haven't successfully authenticated.