It's preferable if you have to give out a macaroon for a third party integration that it's a read-only macaroon that only allows creation of invoices. 

 Right,  I know that difference. But I don't understand why one would give the admin macaroon?