Fully separate. Each mode has its own OAuth connection, its own access token, and its own webhook secret, stored under different option keys (wpdd_access_token vs wpdd_access_token_sandbox). The Live/Sandbox toggle in Settings just decides which pair of credentials the plugin [...]

Your stored GoCardless access tokens (and any other encrypted plugin data) become permanently unreadable, and you'll need to reconnect. Here's why: encryption always uses a 32-byte key — either WPDIRECTDEBIT_SALT if you've defined it in wp-config.php, or, if you [...]

The OAuth handshake for Live mode sends your site's URL (home_url()) to wpdirectdebit.com/, which checks it against a subscriber registry before allowing the flow to proceed — this is how the license/subscription is tied to a specific site. Sandbox [...]