An embodiment may involve persistent storage containing a predefined token and application state. The embodiment may also involve an application configured to communicate with a message bot and perform operations including: (i) receiving, by way of an interface associated with a unit of program code and from the message bot, a command, wherein the command identifies a bot token and a user of a chat session in which the message bot is engaged; (ii) verifying, by the unit of program code, that the bot token matches the predefined token; (iii) verifying, by the unit of program code, that the user is authorized to use the command; (iv) writing, to the persistent storage, an update to the application state, wherein the update is based on the command; and (v) transmitting, by way the interface and to the message bot, a response confirming that the command has been performed.