A bot can host a local site to allow the user to go through the OAuth flow and get a token, but it will always require user interaction initially as the user has to accept connecting to that app. Once you have an access token for a user though, the app can use the refresh token to get a new access token when the old one expires without user intervention (unless they revoke the token in the future).