Make bot mode fetch its own access tokens. Its rly as simple as that on a feature description level.

This wont be needed for AS mode as AS mode due to being well an appservice actually had in mdad ZTP for this aspect since day 0. Appservices after all use static secrets that you define together with the server that can be essentially whatever as long as its a normal url safe base64 string or whatever the exact char set limit was.