I want to make something like an instagram web viewer like http://www.imgrum.org
Now, when I open https://www.instagram.com/developer/
I see that instagram requires some authentication from every user to access their images, but I have never authorized imgrum, yet my images etc. are visible on imgrum.org. How are they doing it? Or am I misinterpreting instragram API documentation?
You don't need authentication from a specific user to access that specific user's public content via the API.
In order to access public Instagram content via the API, you just need to authenticate any single Instagram account.
Once you authenticate any Instagram account, you can, through the access token for that account, access most of the public Instagram content.
As a concrete example, here are 2 GET requests you can make with a single user access token:
1) Request recent images of the user whose access token you have.
https://api.instagram.com/v1/users/self/media/recent/?access_token=ACCESS-TOKEN
Note here the self: meaning the user whose access token is ACCESS-TOKEN.
2) Request recent images of any other user on Instagram with a public account.
https://api.instagram.com/v1/users/{user-id}/media/recent/?access_token=ACCESS-TOKEN
Note here the {user-id} in place of self: meaning you can enter any user-id for any public Instagram account. And also note that this request still requires an ACCESS-TOKEN, but that the user associated with the ACCESS-TOKEN does not have to be the same user associated with user-id.
This is all documented here:
https://www.instagram.com/developer/endpoints/users/
https://www.instagram.com/developer/authentication/
Update:
In order to make the 2nd API call I listed above to any {user-id}, you need the ACCESS-TOKEN (of the authenticated user) to include public-content as part of the scope. In order to get that, your app must be approved by Instagram.