I asked something similar recently. I am fairly new to this and wondered how this even works. I can't imagine that every time you have access to imap, you have to enter your totp. So what and where is the session stored? How is the session shared.

Anybody has experience in deploying oath-toolkit totp authentication for dovecot? It works for ssh in a challenge response fashion, but I have concernes against concatenating the password with the totp digits, because I have difficulties even with su+oath_toolkit...