The other caveat is that, by default, the Bot cannot make API calls back to "http://localhost". Our dev team uses ngrok (https://ngrok.com/) to expose your localhost server as a publicly available HTTPS endpoint.