I guess we can add an explainer in the short term.
Why do we need two separate stings? XYZ app lets me use just one.
We don't ever store spending permissions on the server. To enable receiving, we need a string without spending permissions for the server. To enable spending, we need one string for that never leaves your browser.