Fully separate. Each mode has its own OAuth connection, its own access token, and its own webhook secret, stored under different option keys (wpdd_access_token vs wpdd_access_token_sandbox). The Live/Sandbox toggle in Settings just decides which pair of credentials the plugin reads from — it doesn't share or migrate anything between them. Authorising Sandbox does nothing for Live, and vice versa: you'll connect each one separately, and each needs its own webhook secret pasted into the matching field.