Here's a simple explaination:
There are 2 different types of Instagram bots. Ones that use the private API, and the ones that use the public API.
The ones that use the private API are tricking IG to think it is a mobile device.
Ones using the public API are saying the device is any device, usually a website like iconosquare.
Both types of bots send webrequests to the API. Webrequests are what your browser sends when you visit a website.
These webrequests do actions such as following and liking.
It is possible to create accounts using these bots but the thing is Instagram has been updating their security so account creation is much harder. But you can always just buy created accounts.