See the problem with generating apps like this is that you have no idea what secret sharing even is and it's pretty clear you didn't even bother to research anything. This has so many holes, and secret sharing schemes NEVER send the secret over the network. The secret is the encryption key, not the payload itself, you're conflating the two. You have to send the payload, but you negotiate a secret, not send one in plaintext. And yes, you're sending the password in plaintext, as far as snoopability goes. Don't roll your own crypto. So if you ever use this to send an api key, you should still invalidate the key and change it afterwards. If you don't want to.... well it's your own money on the line.

edit: That's also not what zero knowledge means