Currently, the API credentials for the chat interaction are stored as action token in the config, which is very unhandy.
Therefore, the bot account should be authenticated in the web interface using the OAuth2 flow. The token should then securely being stored in the database.