Not really a hack. You need an auth token and a correctly formatted http request. The trick is the website doesn't allow a human to form that request with its interface.

All the Chatbot does is read the request and change it. Something that's invisible to a normal user.