If you have "less secure apps" you can still use password. Going forward G is pushing use of XOAUTH2 for IMAP auth. There was some noise from the PHP group bec

If you have "less secure apps" you can still use password. Going forward G is pushing use of XOAUTH2 for IMAP auth. There was some noise from the PHP group because the imap_* functions don't do XOAUTH2 (but Net_IMAP and Zend IMAP libs do the trick)