No, an app is explicitly forbidden from ever asking for login/password. Twitter/Facebook do the same thing.

Instead, you use OAuth to fetch an access token. This is far better for the user - they can revoke your app's access without changing passwords, and without all their other apps losing their connections.

Well that's just good practice. Apps would normally ask you to log in once, receive an API token from the server, and continue to use that for the rest of the tokens lifetime. When the token expires, it'll prompt you again for your login.

There's no need to store the credentials -- you can just ask the Apple keychain to store them instead.

No… it could store a session token.

often there is some kind of token you can snag which will last for a decent amount of time. I can't speak to the Instagram API though.