If you open the "Developer Tools" in your web browser you can see a trace of network activity that will show you all that: probably they have a 'web service' with a clear structure that you can imitate to send messages.
You might not quite be able to send those requests with curl, you may need a client that supports cookies or any of the foibles that real web browsers have instead of a simple http client. But it is very possible you can build an API in your favorite programming language to deal with the bots, keeping in mind the asynchronous nature of the thing -- your agent is potentially both a server and a client in multiple domains and very similar things might happen if you push the letter 'k' or if they sent you a message.
The chat service cannot really encrypt or sign messages other than via HTTPS in the web browser: the client is in your physical possession and you can use the debugger and other tools to give up any secrets it contains or just re-write the Javascript to do exactly what you want.
If it were a hassle you might "join 'em rather than beat them" by using a real web browser or simulation of a real web browser.
There are scripting APIs for Windows & Mac, and APIs for handicapped accessibility, a headless Chrome browser that is built to be scripted.