I have multiple Sentry projects and I upload source maps or debug files for each of them. I want to know whether I need one Organization Auth Token per project, or whether one token can cover all of those uploads.

You do not need one Organization Auth Token per project.

An Organization Auth Token is bound to your organization and can authenticate source map and debug file uploads for any project in that organization. Configure each upload with the correct organization and project, and reuse the same token across those projects.

Create separate tokens when you want isolation by use case. For example, use one token for source map uploads in CI and a different token for other Sentry CLI or API work. That way, if one token is compromised or rotated, you can revoke it without breaking unrelated workflows.

For details on token types and recommendations, see the auth tokens documentation.