* OAuth redirect_uri is locked to a single domain. No test.example.com/staging.example.com for testing - you need to create a new app for a testing/staging environment.

* Max of five apps in an account (see above) - we're having to register an Instagram account per app so we can create dev/test versions of the app.

* Can't grant access to other devs for an account.

* Access to the commenting API is whitelist based. API gives an e-mail address, which never responds. Trying to use the API returns JSON with a bitly link to a Google form, which also never responds. We've been waiting some time for them to respond with a yay/nay on comment whitelisting.

* Docs say you should respect privacy setting of photos, but API doesn't tell you which photos are private anywhere.

* The Google Group seems to be a place feedback/bug reports go to die.