This is what the read only macaroon is for, no?
Edit: or the invoices macaroon