Thanks a lot!
It is still weird to me that a server-side application, such as a chat bot, requires this browser-based step to get startet, but at least with your help I got it to work.
I’m caching the access and refresh tokens in a config file, so I don’t have to refresh on every reconnect attempt of the bot. But in case the access_token is rejected, the bot can now request a refresh on its own.