diff --git a/FIPS/scripts/check_content.sh b/FIPS/scripts/check_content.sh
index a30eacec6..236114df6 100755
--- a/FIPS/scripts/check_content.sh
+++ b/FIPS/scripts/check_content.sh
@@ -6,7 +6,7 @@ set -o pipefail
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
 
-if jar tvf $DIR/../target/snowflake-jdbc-fips.jar  | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
+if jar tvf $DIR/../target/snowflake-jdbc-fips.jar  | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^iso3166_" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
   echo "[ERROR] JDBC jar includes class not under the snowflake namespace"
   exit 1
 fi
diff --git a/ci/container/test_authentication.sh b/ci/container/test_authentication.sh
index 9a2eddf27..b270ace5a 100755
--- a/ci/container/test_authentication.sh
+++ b/ci/container/test_authentication.sh
@@ -9,6 +9,8 @@ MVNW_EXE=$SOURCE_ROOT/mvnw
 AUTH_PARAMETER_FILE=./.github/workflows/parameters_aws_auth_tests.json
 eval $(jq -r '.authtestparams | to_entries | map("export \(.key)=\(.value|tostring)")|.[]' $AUTH_PARAMETER_FILE)
 
+export SF_ENABLE_EXPERIMENTAL_AUTHENTICATION=true
+
 $MVNW_EXE -DjenkinsIT \
     -Djava.io.tmpdir=$WORKSPACE \
     -Djacoco.skip.instrument=true \
diff --git a/ci/container/test_component.sh b/ci/container/test_component.sh
index 65efed88d..bd05237e6 100755
--- a/ci/container/test_component.sh
+++ b/ci/container/test_component.sh
@@ -76,6 +76,8 @@ cd $SOURCE_ROOT
 # Avoid connection timeout on plugin dependency fetch or fail-fast when dependency cannot be fetched
 $MVNW_EXE --batch-mode --show-version dependency:go-offline
 
+export SF_ENABLE_EXPERIMENTAL_AUTHENTICATION=true
+
 if [[ "$is_old_driver" == "true" ]]; then
     pushd TestOnly >& /dev/null
         JDBC_VERSION=$($MVNW_EXE org.apache.maven.plugins:maven-help-plugin:2.1.1:evaluate -Dexpression=project.version --batch-mode | grep -v "[INFO]")
diff --git a/ci/scripts/check_content.sh b/ci/scripts/check_content.sh
index 1af33e56a..e74264cb8 100755
--- a/ci/scripts/check_content.sh
+++ b/ci/scripts/check_content.sh
@@ -8,7 +8,7 @@ set -o pipefail
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
 
-if jar tvf $DIR/../../target/snowflake-jdbc${package_modifier}.jar | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
+if jar $DIR/../../target/snowflake-jdbc${package_modifier}.jar | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^iso3166_" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
   echo "[ERROR] JDBC jar includes class not under the snowflake namespace"
   exit 1
 fi
diff --git a/ci/test_windows.bat b/ci/test_windows.bat
index 0234b105c..ed987390f 100644
--- a/ci/test_windows.bat
+++ b/ci/test_windows.bat
@@ -111,6 +111,8 @@ echo "MAVEN OPTIONS %MAVEN_OPTS%"
 REM Avoid connection timeout on plugin dependency fetch or fail-fast when dependency cannot be fetched
 cmd /c %MVNW_EXE% --batch-mode --show-version dependency:go-offline
 
+set SF_ENABLE_EXPERIMENTAL_AUTHENTICATION=true
+
 if "%JDBC_TEST_SUITES%"=="FipsTestSuite" (
     pushd FIPS
     echo "[INFO] Run Fips tests"
diff --git a/linkage-checker-exclusion-rules.xml b/linkage-checker-exclusion-rules.xml
index 64b5860c2..cc7640d8f 100644
--- a/linkage-checker-exclusion-rules.xml
+++ b/linkage-checker-exclusion-rules.xml
@@ -29,6 +29,7 @@
         <Source><Package name="com.google.api.gax"/></Source>
         <Reason>?</Reason>
     </LinkageError>
+
     <LinkageError>
         <Target><Package name="org.osgi"/></Target>
         <Source><Package name="org.apache.tika.config"/></Source>
@@ -49,6 +50,26 @@
         <Source><Package name="org.bouncycastle.pqc.legacy.crypto.ntru"/></Source>
         <Reason>?</Reason>
     </LinkageError>
+    <LinkageError>
+        <Target><Package name="org.cryptomator"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
+    <LinkageError>
+        <Target><Package name="org.opensaml"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
+    <LinkageError>
+        <Target><Package name="jakarta.servlet"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
+    <LinkageError>
+        <Target><Package name="net.shibboleth.utilities"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
     <!--
     <LinkageError>
         <Target><Package name=""/></Target>
diff --git a/parent-pom.xml b/parent-pom.xml
index ce1a87397..0a1c26a2a 100644
--- a/parent-pom.xml
+++ b/parent-pom.xml
@@ -21,7 +21,7 @@
     <apache.httpcore.version>4.4.16</apache.httpcore.version>
     <zstd-jni.version>1.5.6-5</zstd-jni.version>
     <arrow.version>17.0.0</arrow.version>
-    <asm.version>9.3</asm.version>
+    <asm.version>9.6</asm.version>
     <avro.version>1.8.1</avro.version>
     <awaitility.version>4.2.0</awaitility.version>
     <awssdk.version>1.12.655</awssdk.version>
@@ -60,7 +60,7 @@
     <javax.servlet.version>3.1.0</javax.servlet.version>
     <jna.version>5.13.0</jna.version>
     <joda.time.version>2.8.1</joda.time.version>
-    <json.smart.version>2.4.9</json.smart.version>
+    <json.smart.version>2.5.1</json.smart.version>
     <junit4.version>4.13.2</junit4.version>
     <junit.version>5.11.1</junit.version>
     <junit.platform.version>1.11.1</junit.platform.version>
@@ -68,8 +68,9 @@
     <logback.version>1.3.6</logback.version>
     <metrics.version>2.2.0</metrics.version>
     <mockito.version>4.11.0</mockito.version>
+    <nimbusds.oauth2.version>11.20.1</nimbusds.oauth2.version>
     <netty.version>4.1.118.Final</netty.version>
-    <nimbusds.version>9.37.3</nimbusds.version>
+    <nimbusds.version>9.40</nimbusds.version>
     <opencensus.version>0.31.1</opencensus.version>
     <plexus.container.version>1.0-alpha-9-stable-1</plexus.container.version>
     <plexus.utils.version>3.4.2</plexus.utils.version>
@@ -219,6 +220,11 @@
         <artifactId>nimbus-jose-jwt</artifactId>
         <version>${nimbusds.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.nimbusds</groupId>
+        <artifactId>oauth2-oidc-sdk</artifactId>
+        <version>${nimbusds.oauth2.version}</version>
+      </dependency>
       <dependency>
         <groupId>com.yammer.metrics</groupId>
         <artifactId>metrics-core</artifactId>
@@ -657,6 +663,10 @@
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
     </dependency>
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>oauth2-oidc-sdk</artifactId>
+    </dependency>
     <dependency>
       <groupId>com.yammer.metrics</groupId>
       <artifactId>metrics-core</artifactId>
diff --git a/src/main/java/net/snowflake/client/config/SFClientConfigParser.java b/src/main/java/net/snowflake/client/config/SFClientConfigParser.java
index 9d93aed0a..7b05150d9 100644
--- a/src/main/java/net/snowflake/client/config/SFClientConfigParser.java
+++ b/src/main/java/net/snowflake/client/config/SFClientConfigParser.java
@@ -58,11 +58,13 @@ public static SFClientConfig loadSFClientConfig(String configFilePath) throws IO
         derivedConfigFilePath = driverLocation;
       } else {
         // 4. Read SF_CLIENT_CONFIG_FILE_NAME if it is present in user home directory.
-        String userHomeFilePath =
-            Paths.get(systemGetProperty("user.home"), SF_CLIENT_CONFIG_FILE_NAME).toString();
-        if (Files.exists(Paths.get(userHomeFilePath))) {
-          logger.info("Using config file specified from home directory: {}", userHomeFilePath);
-          derivedConfigFilePath = userHomeFilePath;
+        String homeDirectory = systemGetProperty("user.home");
+        if (homeDirectory != null) {
+          String userHomeFilePath = Paths.get(homeDirectory, SF_CLIENT_CONFIG_FILE_NAME).toString();
+          if (Files.exists(Paths.get(userHomeFilePath))) {
+            logger.info("Using config file specified from home directory: {}", userHomeFilePath);
+            derivedConfigFilePath = userHomeFilePath;
+          }
         }
       }
     }
diff --git a/src/main/java/net/snowflake/client/core/AssertUtil.java b/src/main/java/net/snowflake/client/core/AssertUtil.java
index c24139fa9..149634238 100644
--- a/src/main/java/net/snowflake/client/core/AssertUtil.java
+++ b/src/main/java/net/snowflake/client/core/AssertUtil.java
@@ -16,7 +16,8 @@ public class AssertUtil {
    * @param internalErrorMesg The error message to display if condition is false
    * @throws SFException Will be thrown if condition is false
    */
-  static void assertTrue(boolean condition, String internalErrorMesg) throws SFException {
+  @SnowflakeJdbcInternalApi
+  public static void assertTrue(boolean condition, String internalErrorMesg) throws SFException {
     if (!condition) {
       throw new SFException(ErrorCode.INTERNAL_ERROR, internalErrorMesg);
     }
diff --git a/src/main/java/net/snowflake/client/core/CachedCredentialType.java b/src/main/java/net/snowflake/client/core/CachedCredentialType.java
new file mode 100644
index 000000000..2395a91ff
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/CachedCredentialType.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+enum CachedCredentialType {
+  ID_TOKEN("ID_TOKEN"),
+  MFA_TOKEN("MFATOKEN"),
+  OAUTH_ACCESS_TOKEN("OAUTH_ACCESS_TOKEN"),
+  OAUTH_REFRESH_TOKEN("OAUTH_REFRESH_TOKEN");
+
+  private final String value;
+
+  CachedCredentialType(String value) {
+    this.value = value;
+  }
+
+  String getValue() {
+    return value;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/Constants.java b/src/main/java/net/snowflake/client/core/Constants.java
index 608661d22..2d9591b96 100644
--- a/src/main/java/net/snowflake/client/core/Constants.java
+++ b/src/main/java/net/snowflake/client/core/Constants.java
@@ -22,6 +22,10 @@ public final class Constants {
   // Error code for all invalid id token cases during login request
   public static final int ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE = 390195;
 
+  public static final int OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE = 390318;
+
+  public static final int OAUTH_ACCESS_TOKEN_INVALID_GS_CODE = 390303;
+
   // Error message for IOException when no space is left for GET
   public static final String NO_SPACE_LEFT_ON_DEVICE_ERR = "No space left on device";
 
diff --git a/src/main/java/net/snowflake/client/core/CredentialManager.java b/src/main/java/net/snowflake/client/core/CredentialManager.java
index 691430edd..3ca5069c0 100644
--- a/src/main/java/net/snowflake/client/core/CredentialManager.java
+++ b/src/main/java/net/snowflake/client/core/CredentialManager.java
@@ -4,7 +4,10 @@
 
 package net.snowflake.client.core;
 
+import com.amazonaws.util.StringUtils;
 import com.google.common.base.Strings;
+import java.net.URI;
+import net.snowflake.client.jdbc.ErrorCode;
 import net.snowflake.client.log.SFLogger;
 import net.snowflake.client.log.SFLoggerFactory;
 
@@ -13,9 +16,6 @@ public class CredentialManager {
 
   private SecureStorageManager secureStorageManager;
 
-  private static final String ID_TOKEN = "ID_TOKEN";
-  private static final String MFA_TOKEN = "MFATOKEN";
-
   private CredentialManager() {
     initSecureStorageManager();
   }
@@ -37,9 +37,9 @@ private void initSecureStorageManager() {
   }
 
   /** Helper function for tests to go back to normal settings. */
-  void resetSecureStorageManager() {
+  static void resetSecureStorageManager() {
     logger.debug("Resetting the secure storage manager");
-    initSecureStorageManager();
+    getInstance().initSecureStorageManager();
   }
 
   /**
@@ -47,9 +47,9 @@ void resetSecureStorageManager() {
    *
    * @param manager SecureStorageManager
    */
-  void injectSecureStorageManager(SecureStorageManager manager) {
+  static void injectSecureStorageManager(SecureStorageManager manager) {
     logger.debug("Injecting secure storage manager");
-    secureStorageManager = manager;
+    getInstance().secureStorageManager = manager;
   }
 
   private static class CredentialManagerHolder {
@@ -65,12 +65,17 @@ public static CredentialManager getInstance() {
    *
    * @param loginInput login input to attach id token
    */
-  void fillCachedIdToken(SFLoginInput loginInput) throws SFException {
+  static void fillCachedIdToken(SFLoginInput loginInput) throws SFException {
     logger.debug(
         "Looking for cached id token for user: {}, host: {}",
         loginInput.getUserName(),
         loginInput.getHostFromServerUrl());
-    fillCachedCredential(loginInput, ID_TOKEN);
+    getInstance()
+        .fillCachedCredential(
+            loginInput,
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            CachedCredentialType.ID_TOKEN);
   }
 
   /**
@@ -78,32 +83,67 @@ void fillCachedIdToken(SFLoginInput loginInput) throws SFException {
    *
    * @param loginInput login input to attach mfa token
    */
-  void fillCachedMfaToken(SFLoginInput loginInput) throws SFException {
+  static void fillCachedMfaToken(SFLoginInput loginInput) throws SFException {
     logger.debug(
         "Looking for cached mfa token for user: {}, host: {}",
         loginInput.getUserName(),
         loginInput.getHostFromServerUrl());
-    fillCachedCredential(loginInput, MFA_TOKEN);
+    getInstance()
+        .fillCachedCredential(
+            loginInput,
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            CachedCredentialType.MFA_TOKEN);
+  }
+
+  /**
+   * Reuse the cached OAuth access token stored locally
+   *
+   * @param loginInput login input to attach access token
+   */
+  static void fillCachedOAuthAccessToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Looking for cached OAuth access token for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .fillCachedCredential(
+            loginInput, host, loginInput.getUserName(), CachedCredentialType.OAUTH_ACCESS_TOKEN);
   }
 
   /**
-   * Reuse the cached token stored locally
+   * Reuse the cached OAuth refresh token stored locally
    *
-   * @param loginInput login input to attach token
-   * @param credType credential type to retrieve
+   * @param loginInput login input to attach refresh token
    */
-  synchronized void fillCachedCredential(SFLoginInput loginInput, String credType)
+  static void fillCachedOAuthRefreshToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Looking for cached OAuth refresh token for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .fillCachedCredential(
+            loginInput, host, loginInput.getUserName(), CachedCredentialType.OAUTH_REFRESH_TOKEN);
+  }
+
+  /** Reuse the cached token stored locally */
+  synchronized void fillCachedCredential(
+      SFLoginInput loginInput, String host, String username, CachedCredentialType credType)
       throws SFException {
+    if (StringUtils.isNullOrEmpty(username)) {
+      logger.debug("Missing username; Cannot read from credential cache");
+      return;
+    }
     if (secureStorageManager == null) {
       logMissingJnaJarForSecureLocalStorage();
       return;
     }
 
-    String cred = null;
+    String cred;
     try {
-      cred =
-          secureStorageManager.getCredential(
-              loginInput.getHostFromServerUrl(), loginInput.getUserName(), credType);
+      cred = secureStorageManager.getCredential(host, username, credType.getValue());
     } catch (NoClassDefFoundError error) {
       logMissingJnaJarForSecureLocalStorage();
       return;
@@ -113,64 +153,102 @@ synchronized void fillCachedCredential(SFLoginInput loginInput, String credType)
       logger.debug("Retrieved {} is null", credType);
     }
 
-    // cred can be null
-    if (credType == ID_TOKEN) {
-      logger.debug(
-          "Setting {}id token for user: {}, host: {}",
-          cred == null ? "null " : "",
-          loginInput.getUserName(),
-          loginInput.getHostFromServerUrl());
-      loginInput.setIdToken(cred);
-    } else if (credType == MFA_TOKEN) {
-      logger.debug(
-          "Setting {}mfa token for user: {}, host: {}",
-          cred == null ? "null " : "",
-          loginInput.getUserName(),
-          loginInput.getHostFromServerUrl());
-      loginInput.setMfaToken(cred);
-    } else {
-      logger.debug("Unrecognized type {} for local cached credential", credType);
+    logger.debug(
+        "Setting {}{} token for user: {}, host: {}",
+        cred == null ? "null " : "",
+        credType.getValue(),
+        username,
+        host);
+    switch (credType) {
+      case ID_TOKEN:
+        loginInput.setIdToken(cred);
+        break;
+      case MFA_TOKEN:
+        loginInput.setMfaToken(cred);
+        break;
+      case OAUTH_ACCESS_TOKEN:
+        loginInput.setOauthAccessToken(cred);
+        break;
+      case OAUTH_REFRESH_TOKEN:
+        loginInput.setOauthRefreshToken(cred);
+        break;
+      default:
+        throw new SFException(
+            ErrorCode.INTERNAL_ERROR, "Unrecognized type {} for local cached credential", credType);
     }
-    return;
   }
 
-  /**
-   * Store ID Token
-   *
-   * @param loginInput loginInput to denote to the cache
-   * @param loginOutput loginOutput to denote to the cache
-   */
-  void writeIdToken(SFLoginInput loginInput, SFLoginOutput loginOutput) throws SFException {
+  static void writeIdToken(SFLoginInput loginInput, String idToken) throws SFException {
     logger.debug(
         "Caching id token in a secure storage for user: {}, host: {}",
         loginInput.getUserName(),
         loginInput.getHostFromServerUrl());
-    writeTemporaryCredential(loginInput, loginOutput.getIdToken(), ID_TOKEN);
+    getInstance()
+        .writeTemporaryCredential(
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            idToken,
+            CachedCredentialType.ID_TOKEN);
+  }
+
+  static void writeMfaToken(SFLoginInput loginInput, String mfaToken) throws SFException {
+    logger.debug(
+        "Caching mfa token in a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        loginInput.getHostFromServerUrl());
+    getInstance()
+        .writeTemporaryCredential(
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            mfaToken,
+            CachedCredentialType.MFA_TOKEN);
   }
 
   /**
-   * Store MFA Token
+   * Store OAuth Access Token
    *
    * @param loginInput loginInput to denote to the cache
-   * @param loginOutput loginOutput to denote to the cache
    */
-  void writeMfaToken(SFLoginInput loginInput, SFLoginOutput loginOutput) throws SFException {
+  static void writeOAuthAccessToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
     logger.debug(
-        "Caching mfa token in a secure storage for user: {}, host: {}",
+        "Caching OAuth access token in a secure storage for user: {}, host: {}",
         loginInput.getUserName(),
-        loginInput.getHostFromServerUrl());
-    writeTemporaryCredential(loginInput, loginOutput.getMfaToken(), MFA_TOKEN);
+        host);
+    getInstance()
+        .writeTemporaryCredential(
+            host,
+            loginInput.getUserName(),
+            loginInput.getOauthAccessToken(),
+            CachedCredentialType.OAUTH_ACCESS_TOKEN);
   }
 
   /**
-   * Store the temporary credential
+   * Store OAuth Refresh Token
    *
    * @param loginInput loginInput to denote to the cache
-   * @param cred the credential
-   * @param credType type of the credential
    */
-  synchronized void writeTemporaryCredential(SFLoginInput loginInput, String cred, String credType)
-      throws SFException {
+  static void writeOAuthRefreshToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Caching OAuth refresh token in a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .writeTemporaryCredential(
+            host,
+            loginInput.getUserName(),
+            loginInput.getOauthRefreshToken(),
+            CachedCredentialType.OAUTH_REFRESH_TOKEN);
+  }
+
+  /** Store the temporary credential */
+  synchronized void writeTemporaryCredential(
+      String host, String user, String cred, CachedCredentialType credType) {
+    if (StringUtils.isNullOrEmpty(user)) {
+      logger.debug("Missing username; Cannot write to credential cache");
+      return;
+    }
     if (Strings.isNullOrEmpty(cred)) {
       logger.debug("No {} is given.", credType);
       return; // no credential
@@ -182,25 +260,62 @@ synchronized void writeTemporaryCredential(SFLoginInput loginInput, String cred,
     }
 
     try {
-      secureStorageManager.setCredential(
-          loginInput.getHostFromServerUrl(), loginInput.getUserName(), credType, cred);
+      secureStorageManager.setCredential(host, user, credType.getValue(), cred);
     } catch (NoClassDefFoundError error) {
       logMissingJnaJarForSecureLocalStorage();
     }
   }
 
   /** Delete the id token cache */
-  void deleteIdTokenCache(String host, String user) {
+  static void deleteIdTokenCache(String host, String user) {
     logger.debug(
         "Removing cached id token from a secure storage for user: {}, host: {}", user, host);
-    deleteTemporaryCredential(host, user, ID_TOKEN);
+    getInstance().deleteTemporaryCredential(host, user, CachedCredentialType.ID_TOKEN);
   }
 
   /** Delete the mfa token cache */
-  void deleteMfaTokenCache(String host, String user) {
+  static void deleteMfaTokenCache(String host, String user) {
     logger.debug(
         "Removing cached mfa token from a secure storage for user: {}, host: {}", user, host);
-    deleteTemporaryCredential(host, user, MFA_TOKEN);
+    getInstance().deleteTemporaryCredential(host, user, CachedCredentialType.MFA_TOKEN);
+  }
+
+  /** Delete the OAuth access token cache */
+  static void deleteOAuthAccessTokenCache(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Removing cached OAuth access token from a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .deleteTemporaryCredential(
+            host, loginInput.getUserName(), CachedCredentialType.OAUTH_ACCESS_TOKEN);
+  }
+
+  /** Delete the OAuth refresh token cache */
+  static void deleteOAuthRefreshTokenCache(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Removing cached OAuth refresh token from a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .deleteTemporaryCredential(
+            host, loginInput.getUserName(), CachedCredentialType.OAUTH_REFRESH_TOKEN);
+  }
+
+  /**
+   * Method required for OAuth token caching, since actual token is not Snowflake account-specific,
+   * but rather IdP-specific
+   */
+  static String getHostForOAuthCacheKey(SFLoginInput loginInput) throws SFException {
+    String oauthTokenRequestUrl = loginInput.getOauthLoginInput().getTokenRequestUrl();
+    if (oauthTokenRequestUrl != null) {
+      URI parsedUrl = URI.create(oauthTokenRequestUrl);
+      return parsedUrl.getHost();
+    } else {
+      return loginInput.getHostFromServerUrl();
+    }
   }
 
   /**
@@ -210,14 +325,19 @@ void deleteMfaTokenCache(String host, String user) {
    * @param user user name
    * @param credType type of the credential
    */
-  synchronized void deleteTemporaryCredential(String host, String user, String credType) {
+  synchronized void deleteTemporaryCredential(
+      String host, String user, CachedCredentialType credType) {
     if (secureStorageManager == null) {
       logMissingJnaJarForSecureLocalStorage();
       return;
     }
+    if (StringUtils.isNullOrEmpty(user)) {
+      logger.debug("Missing username; Cannot delete from credential cache");
+      return;
+    }
 
     try {
-      secureStorageManager.deleteCredential(host, user, credType);
+      secureStorageManager.deleteCredential(host, user, credType.getValue());
     } catch (NoClassDefFoundError error) {
       logMissingJnaJarForSecureLocalStorage();
     }
diff --git a/src/main/java/net/snowflake/client/core/FileCacheManager.java b/src/main/java/net/snowflake/client/core/FileCacheManager.java
index 2d00d6d0a..199d22b04 100644
--- a/src/main/java/net/snowflake/client/core/FileCacheManager.java
+++ b/src/main/java/net/snowflake/client/core/FileCacheManager.java
@@ -4,6 +4,7 @@
 
 package net.snowflake.client.core;
 
+import static net.snowflake.client.core.FileUtil.isWritable;
 import static net.snowflake.client.jdbc.SnowflakeUtil.isWindows;
 import static net.snowflake.client.jdbc.SnowflakeUtil.systemGetEnv;
 import static net.snowflake.client.jdbc.SnowflakeUtil.systemGetProperty;
@@ -27,6 +28,7 @@
 import java.nio.file.attribute.PosixFilePermission;
 import java.nio.file.attribute.PosixFilePermissions;
 import java.util.Date;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 import net.snowflake.client.log.SFLogger;
@@ -43,7 +45,6 @@ class FileCacheManager {
   private String cacheDirectorySystemProperty;
   private String cacheDirectoryEnvironmentVariable;
   private String baseCacheFileName;
-  private long cacheExpirationInMilliseconds;
   private long cacheFileLockExpirationInMilliseconds;
 
   private File cacheFile;
@@ -74,12 +75,6 @@ FileCacheManager setBaseCacheFileName(String baseCacheFileName) {
     return this;
   }
 
-  FileCacheManager setCacheExpirationInSeconds(long cacheExpirationInSeconds) {
-    // converting from seconds to milliseconds
-    this.cacheExpirationInMilliseconds = cacheExpirationInSeconds * 1000;
-    return this;
-  }
-
   FileCacheManager setCacheFileLockExpirationInSeconds(long cacheFileLockExpirationInSeconds) {
     this.cacheFileLockExpirationInMilliseconds = cacheFileLockExpirationInSeconds * 1000;
     return this;
@@ -90,17 +85,22 @@ FileCacheManager setOnlyOwnerPermissions(boolean onlyOwnerPermissions) {
     return this;
   }
 
+  synchronized String getCacheFilePath() {
+    return cacheFile.getAbsolutePath();
+  }
+
   /**
    * Override the cache file.
    *
    * @param newCacheFile a file object to override the default one.
    */
-  void overrideCacheFile(File newCacheFile) {
+  synchronized void overrideCacheFile(File newCacheFile) {
     if (!newCacheFile.exists()) {
       logger.debug("Cache file doesn't exists. File: {}", newCacheFile);
     }
     if (onlyOwnerPermissions) {
-      FileUtil.throwWhenPermiossionDifferentThanReadWriteForOwner(
+      FileUtil.handleWhenFilePermissionsWiderThanUserOnly(newCacheFile, "Override cache file");
+      FileUtil.handleWhenParentDirectoryPermissionsWiderThanUserOnly(
           newCacheFile, "Override cache file");
     } else {
       FileUtil.logFileUsage(cacheFile, "Override cache file", false);
@@ -110,7 +110,7 @@ void overrideCacheFile(File newCacheFile) {
     this.baseCacheFileName = newCacheFile.getName();
   }
 
-  FileCacheManager build() {
+  synchronized FileCacheManager build() {
     // try to get cacheDir from system property or environment variable
     String cacheDirPath =
         this.cacheDirectorySystemProperty != null
@@ -134,32 +134,30 @@ FileCacheManager build() {
     if (cacheDirPath != null) {
       this.cacheDir = new File(cacheDirPath);
     } else {
-      // use user home directory to store the cache file
-      String homeDir = systemGetProperty("user.home");
-      if (homeDir != null) {
-        // Checking if home directory is writable.
-        File homeFile = new File(homeDir);
-        if (!homeFile.canWrite()) {
-          logger.debug("Home directory not writeable, skip using cache", false);
-          homeDir = null;
-        }
-      }
-      if (homeDir == null) {
-        // if still home directory is null, no cache dir is set.
+      this.cacheDir = getDefaultCacheDir();
+    }
+    if (cacheDir == null) {
+      return this;
+    }
+    if (!cacheDir.exists()) {
+      try {
+        Files.createDirectories(
+            cacheDir.toPath(),
+            PosixFilePermissions.asFileAttribute(
+                Stream.of(
+                        PosixFilePermission.OWNER_READ,
+                        PosixFilePermission.OWNER_WRITE,
+                        PosixFilePermission.OWNER_EXECUTE)
+                    .collect(Collectors.toSet())));
+      } catch (IOException e) {
+        logger.info(
+            "Failed to create the cache directory: {}. Ignored. {}",
+            e.getMessage(),
+            cacheDir.getAbsoluteFile());
         return this;
       }
-      if (Constants.getOS() == Constants.OS.WINDOWS) {
-        this.cacheDir =
-            new File(
-                new File(new File(new File(homeDir, "AppData"), "Local"), "Snowflake"), "Caches");
-      } else if (Constants.getOS() == Constants.OS.MAC) {
-        this.cacheDir = new File(new File(new File(homeDir, "Library"), "Caches"), "Snowflake");
-      } else {
-        this.cacheDir = new File(new File(homeDir, ".cache"), "snowflake");
-      }
     }
-
-    if (!this.cacheDir.mkdirs() && !this.cacheDir.exists()) {
+    if (!this.cacheDir.exists()) {
       logger.debug(
           "Cannot create the cache directory {}. Giving up.", this.cacheDir.getAbsolutePath());
       return this;
@@ -199,12 +197,72 @@ FileCacheManager build() {
     return this;
   }
 
-  /** Reads the cache file. */
-  JsonNode readCacheFile() {
-    if (cacheFile == null || !this.checkCacheLockFile()) {
-      // no cache or the cache is not valid.
+  static File getDefaultCacheDir() {
+    if (Constants.getOS() == Constants.OS.LINUX) {
+      String xdgCacheHome = getXdgCacheHome();
+      if (xdgCacheHome != null) {
+        return new File(xdgCacheHome, "snowflake");
+      }
+    }
+
+    String homeDir = getHomeDirProperty();
+    if (homeDir == null) {
+      // if still home directory is null, no cache dir is set.
+      return null;
+    }
+    if (Constants.getOS() == Constants.OS.WINDOWS) {
+      return new File(
+          new File(new File(new File(homeDir, "AppData"), "Local"), "Snowflake"), "Caches");
+    } else if (Constants.getOS() == Constants.OS.MAC) {
+      return new File(new File(new File(homeDir, "Library"), "Caches"), "Snowflake");
+    } else {
+      return new File(new File(homeDir, ".cache"), "snowflake");
+    }
+  }
+
+  private static String getXdgCacheHome() {
+    String xdgCacheHome = systemGetEnv("XDG_CACHE_HOME");
+    if (xdgCacheHome != null && isWritable(xdgCacheHome)) {
+      return xdgCacheHome;
+    }
+    return null;
+  }
+
+  private static String getHomeDirProperty() {
+    String homeDir = systemGetProperty("user.home");
+    if (homeDir != null && isWritable(homeDir)) {
+      return homeDir;
+    }
+    return null;
+  }
+
+  synchronized <T> T withLock(Supplier<T> supplier) {
+    if (cacheFile == null) {
+      logger.error("No cache file assigned", false);
+      return null;
+    }
+    if (cacheLockFile == null) {
+      logger.error("No cache lock file assigned", false);
       return null;
+    } else if (cacheLockFile.exists()) {
+      deleteCacheLockIfExpired();
     }
+
+    if (!tryToLockCacheFile()) {
+      logger.debug("Failed to lock the file. Skipping cache operation", false);
+      return null;
+    }
+    try {
+      return supplier.get();
+    } finally {
+      if (!unlockCacheFile()) {
+        logger.debug("Failed to unlock cache file", false);
+      }
+    }
+  }
+
+  /** Reads the cache file. */
+  synchronized JsonNode readCacheFile() {
     try {
       if (!cacheFile.exists()) {
         logger.debug("Cache file doesn't exists. File: {}", cacheFile);
@@ -215,7 +273,8 @@ JsonNode readCacheFile() {
           new InputStreamReader(new FileInputStream(cacheFile), DEFAULT_FILE_ENCODING)) {
 
         if (onlyOwnerPermissions) {
-          FileUtil.throwWhenPermiossionDifferentThanReadWriteForOwner(cacheFile, "Read cache");
+          FileUtil.handleWhenFilePermissionsWiderThanUserOnly(cacheFile, "Read cache");
+          FileUtil.handleWhenParentDirectoryPermissionsWiderThanUserOnly(cacheFile, "Read cache");
           FileUtil.throwWhenOwnerDifferentThanCurrentUser(cacheFile, "Read cache");
         } else {
           FileUtil.logFileUsage(cacheFile, "Read cache", false);
@@ -228,15 +287,8 @@ JsonNode readCacheFile() {
     return null;
   }
 
-  void writeCacheFile(JsonNode input) {
+  synchronized void writeCacheFile(JsonNode input) {
     logger.debug("Writing cache file. File: {}", cacheFile);
-    if (cacheFile == null || !tryLockCacheFile()) {
-      // no cache file or it failed to lock file
-      logger.debug(
-          "No cache file exists or failed to lock the file. Skipping writing the cache", false);
-      return;
-    }
-    // NOTE: must unlock cache file
     try {
       if (input == null) {
         return;
@@ -244,7 +296,9 @@ void writeCacheFile(JsonNode input) {
       try (Writer writer =
           new OutputStreamWriter(new FileOutputStream(cacheFile), DEFAULT_FILE_ENCODING)) {
         if (onlyOwnerPermissions) {
-          FileUtil.throwWhenPermiossionDifferentThanReadWriteForOwner(cacheFile, "Write to cache");
+          FileUtil.handleWhenFilePermissionsWiderThanUserOnly(cacheFile, "Write to cache");
+          FileUtil.handleWhenParentDirectoryPermissionsWiderThanUserOnly(
+              cacheFile, "Write to cache");
         } else {
           FileUtil.logFileUsage(cacheFile, "Write to cache", false);
         }
@@ -252,14 +306,10 @@ void writeCacheFile(JsonNode input) {
       }
     } catch (IOException ex) {
       logger.debug("Failed to write the cache file. File: {}", cacheFile);
-    } finally {
-      if (!unlockCacheFile()) {
-        logger.debug("Failed to unlock cache file", false);
-      }
     }
   }
 
-  void deleteCacheFile() {
+  synchronized void deleteCacheFile() {
     logger.debug("Deleting cache file. File: {}, lock file: {}", cacheFile, cacheLockFile);
 
     if (cacheFile == null) {
@@ -277,68 +327,44 @@ void deleteCacheFile() {
    *
    * @return true if success or false
    */
-  private boolean tryLockCacheFile() {
+  private synchronized boolean tryToLockCacheFile() {
     int cnt = 0;
     boolean locked = false;
-    while (cnt < 100 && !(locked = lockCacheFile())) {
+    while (cnt < 5 && !(locked = lockCacheFile())) {
       try {
-        Thread.sleep(100);
+        Thread.sleep(10);
       } catch (InterruptedException ex) {
         // doesn't matter
       }
       ++cnt;
     }
     if (!locked) {
-      logger.debug("Failed to lock the cache file.", false);
+      deleteCacheLockIfExpired();
+      if (!lockCacheFile()) {
+        logger.debug("Failed to lock the cache file.", false);
+      }
     }
     return locked;
   }
 
-  /**
-   * Lock cache file by creating a lock directory
-   *
-   * @return true if success or false
-   */
-  private boolean lockCacheFile() {
-    return cacheLockFile.mkdirs();
-  }
-
-  /**
-   * Unlock cache file by deleting a lock directory
-   *
-   * @return true if success or false
-   */
-  private boolean unlockCacheFile() {
-    return cacheLockFile.delete();
-  }
-
-  private boolean checkCacheLockFile() {
+  private synchronized void deleteCacheLockIfExpired() {
     long currentTime = new Date().getTime();
-    long cacheFileTs = fileCreationTime(cacheFile);
-
-    if (!cacheLockFile.exists()
-        && cacheFileTs > 0
-        && currentTime - this.cacheExpirationInMilliseconds <= cacheFileTs) {
-      logger.debug("No cache file lock directory exists and cache file is up to date.", false);
-      return true;
-    }
-
     long lockFileTs = fileCreationTime(cacheLockFile);
     if (lockFileTs < 0) {
-      // failed to get the timestamp of lock directory
-      return false;
-    }
-    if (lockFileTs < currentTime - this.cacheFileLockExpirationInMilliseconds) {
+      logger.debug("Failed to get the timestamp of lock directory");
+    } else if (lockFileTs < currentTime - this.cacheFileLockExpirationInMilliseconds) {
       // old lock file
-      if (!cacheLockFile.delete()) {
-        logger.debug("Failed to delete the directory. Dir: {}", cacheLockFile);
-        return false;
+      try {
+        if (!cacheLockFile.delete()) {
+          logger.debug("Failed to delete the directory. Dir: {}", cacheLockFile);
+        } else {
+          logger.debug("Deleted expired cache lock directory.", false);
+        }
+      } catch (Exception e) {
+        logger.debug(
+            "Failed to delete the directory. Dir: {}, Error: {}", cacheLockFile, e.getMessage());
       }
-      logger.debug("Deleted the cache lock directory, because it was old.", false);
-      return currentTime - this.cacheExpirationInMilliseconds <= cacheFileTs;
     }
-    logger.debug("Failed to lock the file. Ignored.", false);
-    return false;
   }
 
   /**
@@ -346,7 +372,7 @@ private boolean checkCacheLockFile() {
    *
    * @return epoch time in ms
    */
-  private static long fileCreationTime(File targetFile) {
+  private static synchronized long fileCreationTime(File targetFile) {
     if (!targetFile.exists()) {
       logger.debug("File not exists. File: {}", targetFile);
       return -1;
@@ -361,7 +387,21 @@ private static long fileCreationTime(File targetFile) {
     return -1;
   }
 
-  String getCacheFilePath() {
-    return cacheFile.getAbsolutePath();
+  /**
+   * Lock cache file by creating a lock directory
+   *
+   * @return true if success or false
+   */
+  private synchronized boolean lockCacheFile() {
+    return cacheLockFile.mkdirs();
+  }
+
+  /**
+   * Unlock cache file by deleting a lock directory
+   *
+   * @return true if success or false
+   */
+  private synchronized boolean unlockCacheFile() {
+    return cacheLockFile.delete();
   }
 }
diff --git a/src/main/java/net/snowflake/client/core/FileUtil.java b/src/main/java/net/snowflake/client/core/FileUtil.java
index 005b9ac18..cbd493f65 100644
--- a/src/main/java/net/snowflake/client/core/FileUtil.java
+++ b/src/main/java/net/snowflake/client/core/FileUtil.java
@@ -41,12 +41,33 @@ public static void logFileUsage(String stringPath, String context, boolean logRe
     logFileUsage(path, context, logReadAccess);
   }
 
-  public static void throwWhenPermiossionDifferentThanReadWriteForOwner(File file, String context) {
-    throwWhenPermiossionDifferentThanReadWriteForOwner(file.toPath(), context);
+  public static boolean isWritable(String path) {
+    File file = new File(path);
+    if (!file.canWrite()) {
+      logger.debug("File/directory not writeable: {}", path);
+      return false;
+    }
+    return true;
+  }
+
+  public static void handleWhenParentDirectoryPermissionsWiderThanUserOnly(
+      File file, String context) {
+    handleWhenDirectoryPermissionsWiderThanUserOnly(file.getParentFile(), context);
+  }
+
+  public static void handleWhenFilePermissionsWiderThanUserOnly(File file, String context) {
+    if (Files.isSymbolicLink(file.toPath())) {
+      throw new SecurityException("Symbolic link is not allowed for file cache: " + file);
+    }
+    handleWhenPermissionsWiderThanUserOnly(file.toPath(), context, false);
   }
 
-  public static void throwWhenPermiossionDifferentThanReadWriteForOwner(
-      Path filePath, String context) {
+  public static void handleWhenDirectoryPermissionsWiderThanUserOnly(File file, String context) {
+    handleWhenPermissionsWiderThanUserOnly(file.toPath(), context, true);
+  }
+
+  public static void handleWhenPermissionsWiderThanUserOnly(
+      Path filePath, String context, boolean isDirectory) {
     // we do not check the permissions for Windows
     if (isWindows()) {
       return;
@@ -58,16 +79,42 @@ public static void throwWhenPermiossionDifferentThanReadWriteForOwner(
       boolean isReadableByOthers = isPermPresent(filePermissions, READ_BY_OTHERS);
       boolean isExecutable = isPermPresent(filePermissions, EXECUTABLE);
 
-      if (isWritableByOthers || isReadableByOthers || isExecutable) {
+      boolean permissionsTooOpen;
+      if (isDirectory) {
+        permissionsTooOpen = isWritableByOthers || isReadableByOthers;
+      } else {
+        permissionsTooOpen = isWritableByOthers || isReadableByOthers || isExecutable;
+      }
+      if (permissionsTooOpen) {
         logger.debug(
-            "{}File {} access rights: {}", getContextStr(context), filePath, filePermissions);
-        throw new SecurityException(
-            String.format("Access to file %s is wider than allowed only to the owner", filePath));
+            "{}File/directory {} access rights: {}",
+            getContextStr(context),
+            filePath,
+            filePermissions);
+        String message =
+            String.format(
+                "Access to file or directory %s is wider than allowed. Remove cache file/directory and re-run the driver.",
+                filePath);
+        if (isDirectory) {
+          logger.warn(message);
+        } else {
+          throw new SecurityException(message);
+        }
+      } else {
+        if (!isDirectory && Files.isSymbolicLink(filePath)) {
+          throw new SecurityException("Symbolic link is not allowed for file cache: " + filePath);
+        }
       }
     } catch (IOException e) {
-      throw new SecurityException(
+      String message =
           String.format(
-              "%s Unable to access the file to check the permissions. Error: %s", filePath, e));
+              "%s Unable to access the file/directory to check the permissions. Error: %s",
+              filePath, e);
+      if (isDirectory) {
+        logger.warn(message);
+      } else {
+        throw new SecurityException(message);
+      }
     }
   }
 
diff --git a/src/main/java/net/snowflake/client/core/HexUtil.java b/src/main/java/net/snowflake/client/core/HexUtil.java
new file mode 100644
index 000000000..1200af0e6
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/HexUtil.java
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+class HexUtil {
+
+  /**
+   * Converts Byte array to hex string
+   *
+   * @param bytes a byte array
+   * @return a string in hexadecimal code
+   */
+  static String byteToHexString(byte[] bytes) {
+    final char[] hexArray = "0123456789ABCDEF".toCharArray();
+    char[] hexChars = new char[bytes.length * 2];
+    for (int j = 0; j < bytes.length; j++) {
+      int v = bytes[j] & 0xFF;
+      hexChars[j * 2] = hexArray[v >>> 4];
+      hexChars[j * 2 + 1] = hexArray[v & 0x0F];
+    }
+    return new String(hexChars);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/SFLoginInput.java b/src/main/java/net/snowflake/client/core/SFLoginInput.java
index 5f52b64af..440c4c720 100644
--- a/src/main/java/net/snowflake/client/core/SFLoginInput.java
+++ b/src/main/java/net/snowflake/client/core/SFLoginInput.java
@@ -19,6 +19,7 @@ public class SFLoginInput {
   private String warehouse;
   private String role;
   private boolean validateDefaultParameters;
+  private String originalAuthenticator;
   private String authenticator;
   private String oktaUserName;
   private String accountName;
@@ -41,6 +42,8 @@ public class SFLoginInput {
   private String application;
   private String idToken;
   private String mfaToken;
+  private String oauthAccessToken;
+  private String oauthRefreshToken;
   private String serviceName;
   private OCSPMode ocspMode;
   private HttpClientSettingsKey httpClientKey;
@@ -49,6 +52,8 @@ public class SFLoginInput {
   private String privateKeyPwd;
   private String inFlightCtx; // Opaque string sent for Snowsight account activation
 
+  private SFOauthLoginInput oauthLoginInput;
+
   private boolean disableConsoleLogin = true;
   private boolean disableSamlURLCheck = false;
   private boolean enableClientStoreTemporaryCredential;
@@ -59,7 +64,8 @@ public class SFLoginInput {
   // Additional headers to add for Snowsight.
   Map<String, String> additionalHttpHeadersForSnowsight;
 
-  SFLoginInput() {}
+  @SnowflakeJdbcInternalApi
+  public SFLoginInput() {}
 
   Duration getBrowserResponseTimeout() {
     return browserResponseTimeout;
@@ -74,7 +80,8 @@ public String getServerUrl() {
     return serverUrl;
   }
 
-  SFLoginInput setServerUrl(String serverUrl) {
+  @SnowflakeJdbcInternalApi
+  public SFLoginInput setServerUrl(String serverUrl) {
     this.serverUrl = serverUrl;
     return this;
   }
@@ -160,7 +167,8 @@ public SFLoginInput setAccountName(String accountName) {
     return this;
   }
 
-  int getLoginTimeout() {
+  @SnowflakeJdbcInternalApi
+  public int getLoginTimeout() {
     return loginTimeout;
   }
 
@@ -184,7 +192,8 @@ SFLoginInput setRetryTimeout(int retryTimeout) {
     return this;
   }
 
-  int getAuthTimeout() {
+  @SnowflakeJdbcInternalApi
+  public int getAuthTimeout() {
     return authTimeout;
   }
 
@@ -238,7 +247,8 @@ SFLoginInput setConnectionTimeout(Duration connectionTimeout) {
     return this;
   }
 
-  int getSocketTimeoutInMillis() {
+  @SnowflakeJdbcInternalApi
+  public int getSocketTimeoutInMillis() {
     return (int) socketTimeout.toMillis();
   }
 
@@ -310,6 +320,25 @@ SFLoginInput setMfaToken(String mfaToken) {
     return this;
   }
 
+  String getOauthAccessToken() {
+    return oauthAccessToken;
+  }
+
+  SFLoginInput setOauthAccessToken(String oauthAccessToken) {
+    this.oauthAccessToken = oauthAccessToken;
+    return this;
+  }
+
+  @SnowflakeJdbcInternalApi
+  public String getOauthRefreshToken() {
+    return oauthRefreshToken;
+  }
+
+  SFLoginInput setOauthRefreshToken(String oauthRefreshToken) {
+    this.oauthRefreshToken = oauthRefreshToken;
+    return this;
+  }
+
   Map<String, Object> getSessionParameters() {
     return sessionParameters;
   }
@@ -388,7 +417,8 @@ SFLoginInput setOCSPMode(OCSPMode ocspMode) {
     return this;
   }
 
-  HttpClientSettingsKey getHttpClientSettingsKey() {
+  @SnowflakeJdbcInternalApi
+  public HttpClientSettingsKey getHttpClientSettingsKey() {
     return httpClientKey;
   }
 
@@ -396,13 +426,13 @@ SFLoginInput setHttpClientSettingsKey(HttpClientSettingsKey key) {
     this.httpClientKey = key;
     return this;
   }
-
   // Opaque string sent for Snowsight account activation
+
   String getInFlightCtx() {
     return inFlightCtx;
   }
-
   // Opaque string sent for Snowsight account activation
+
   SFLoginInput setInFlightCtx(String inFlightCtx) {
     this.inFlightCtx = inFlightCtx;
     return this;
@@ -420,7 +450,6 @@ SFLoginInput setDisableSamlURLCheck(boolean disableSamlURLCheck) {
   Map<String, String> getAdditionalHttpHeadersForSnowsight() {
     return additionalHttpHeadersForSnowsight;
   }
-
   /**
    * Set additional http headers to apply to the outgoing request. The additional headers cannot be
    * used to replace or overwrite a header in use by the driver. These will be applied to the
@@ -485,4 +514,28 @@ SFLoginInput setEnableClientRequestMfaToken(boolean enableClientRequestMfaToken)
     this.enableClientRequestMfaToken = enableClientRequestMfaToken;
     return this;
   }
+
+  @SnowflakeJdbcInternalApi
+  public SFOauthLoginInput getOauthLoginInput() {
+    return oauthLoginInput;
+  }
+
+  @SnowflakeJdbcInternalApi
+  public SFLoginInput setOauthLoginInput(SFOauthLoginInput oauthLoginInput) {
+    this.oauthLoginInput = oauthLoginInput;
+    return this;
+  }
+
+  void restoreOriginalAuthenticator() {
+    this.authenticator = this.originalAuthenticator;
+  }
+
+  String getOriginalAuthenticator() {
+    return this.originalAuthenticator;
+  }
+
+  SFLoginInput setOriginalAuthenticator(String originalAuthenticator) {
+    this.originalAuthenticator = originalAuthenticator;
+    return this;
+  }
 }
diff --git a/src/main/java/net/snowflake/client/core/SFLoginOutput.java b/src/main/java/net/snowflake/client/core/SFLoginOutput.java
index 3470076b9..f52b9c0af 100644
--- a/src/main/java/net/snowflake/client/core/SFLoginOutput.java
+++ b/src/main/java/net/snowflake/client/core/SFLoginOutput.java
@@ -14,6 +14,8 @@ public class SFLoginOutput {
   private long masterTokenValidityInSeconds;
   private String idToken;
   private String mfaToken;
+  private String oauthAccessToken;
+  private String oauthRefreshToken;
   private String databaseVersion;
   private int databaseMajorVersion;
   private int databaseMinorVersion;
@@ -35,6 +37,8 @@ public class SFLoginOutput {
       long masterTokenValidityInSeconds,
       String idToken,
       String mfaToken,
+      String oauthAccessToken,
+      String oauthRefreshToken,
       String databaseVersion,
       int databaseMajorVersion,
       int databaseMinorVersion,
@@ -50,6 +54,8 @@ public class SFLoginOutput {
     this.masterToken = masterToken;
     this.idToken = idToken;
     this.mfaToken = mfaToken;
+    this.oauthAccessToken = oauthAccessToken;
+    this.oauthRefreshToken = oauthRefreshToken;
     this.databaseVersion = databaseVersion;
     this.databaseMajorVersion = databaseMajorVersion;
     this.databaseMinorVersion = databaseMinorVersion;
@@ -98,6 +104,14 @@ String getMfaToken() {
     return mfaToken;
   }
 
+  String getOauthAccessToken() {
+    return oauthAccessToken;
+  }
+
+  String getOauthRefreshToken() {
+    return oauthRefreshToken;
+  }
+
   String getDatabaseVersion() {
     return databaseVersion;
   }
diff --git a/src/main/java/net/snowflake/client/core/SFOauthLoginInput.java b/src/main/java/net/snowflake/client/core/SFOauthLoginInput.java
new file mode 100644
index 000000000..1797b20fb
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/SFOauthLoginInput.java
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+@SnowflakeJdbcInternalApi
+public class SFOauthLoginInput {
+
+  private final String clientId;
+  private final String clientSecret;
+  private final String redirectUri;
+  private final String authorizationUrl;
+  private final String tokenRequestUrl;
+  private final String scope;
+
+  public SFOauthLoginInput(
+      String clientId,
+      String clientSecret,
+      String redirectUri,
+      String authorizationUrl,
+      String tokenRequestUrl,
+      String scope) {
+    this.redirectUri = redirectUri;
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+    this.authorizationUrl = authorizationUrl;
+    this.tokenRequestUrl = tokenRequestUrl;
+    this.scope = scope;
+  }
+
+  public String getRedirectUri() {
+    return redirectUri;
+  }
+
+  public String getClientId() {
+    return clientId;
+  }
+
+  public String getClientSecret() {
+    return clientSecret;
+  }
+
+  public String getAuthorizationUrl() {
+    return authorizationUrl;
+  }
+
+  public String getTokenRequestUrl() {
+    return tokenRequestUrl;
+  }
+
+  public String getScope() {
+    return scope;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/SFSession.java b/src/main/java/net/snowflake/client/core/SFSession.java
index 10a45b98b..129519a4b 100644
--- a/src/main/java/net/snowflake/client/core/SFSession.java
+++ b/src/main/java/net/snowflake/client/core/SFSession.java
@@ -86,6 +86,8 @@ public class SFSession extends SFBaseSession {
   private long masterTokenValidityInSeconds;
   private String idToken;
   private String mfaToken;
+  private String oauthAccessToken;
+  private String oauthRefreshToken;
   private String privateKeyFileLocation;
   private String privateKeyBase64;
   private String privateKeyPassword;
@@ -260,7 +262,7 @@ private JsonNode getQueryMetadata(String queryID) throws SQLException {
             // If we fail to renew the session based on a re-authentication error, try to
             // re-authenticate the session first
             if (ex instanceof SnowflakeReauthenticationRequest
-                && this.isExternalbrowserAuthenticator()) {
+                && this.isExternalbrowserOrOAuthFullFlowAuthenticator()) {
               try {
                 this.open();
               } catch (SFException e) {
@@ -675,6 +677,14 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
 
     // TODO: temporarily hardcode sessionParameter debug info. will be changed in the future
     SFLoginInput loginInput = new SFLoginInput();
+    SFOauthLoginInput oauthLoginInput =
+        new SFOauthLoginInput(
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_CLIENT_ID),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_CLIENT_SECRET),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_REDIRECT_URI),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_AUTHORIZATION_URL),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_TOKEN_REQUEST_URL),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_SCOPE));
 
     loginInput
         .setServerUrl((String) connectionPropertiesMap.get(SFSessionProperty.SERVER_URL))
@@ -685,6 +695,8 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
         .setValidateDefaultParameters(
             connectionPropertiesMap.get(SFSessionProperty.VALIDATE_DEFAULT_PARAMETERS))
         .setAuthenticator((String) connectionPropertiesMap.get(SFSessionProperty.AUTHENTICATOR))
+        .setOriginalAuthenticator(
+            (String) connectionPropertiesMap.get(SFSessionProperty.AUTHENTICATOR))
         .setOKTAUserName((String) connectionPropertiesMap.get(SFSessionProperty.OKTA_USERNAME))
         .setAccountName((String) connectionPropertiesMap.get(SFSessionProperty.ACCOUNT))
         .setLoginTimeout(loginTimeout)
@@ -712,6 +724,7 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
         .setSessionParameters(sessionParametersMap)
         .setPrivateKey((PrivateKey) connectionPropertiesMap.get(SFSessionProperty.PRIVATE_KEY))
         .setPrivateKeyFile((String) connectionPropertiesMap.get(SFSessionProperty.PRIVATE_KEY_FILE))
+        .setOauthLoginInput(oauthLoginInput)
         .setPrivateKeyBase64(
             (String) connectionPropertiesMap.get(SFSessionProperty.PRIVATE_KEY_BASE64))
         .setPrivateKeyPwd(
@@ -761,6 +774,8 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
     masterToken = loginOutput.getMasterToken();
     idToken = loginOutput.getIdToken();
     mfaToken = loginOutput.getMfaToken();
+    oauthAccessToken = loginOutput.getOauthAccessToken();
+    oauthRefreshToken = loginOutput.getOauthRefreshToken();
     setDatabaseVersion(loginOutput.getDatabaseVersion());
     setDatabaseMajorVersion(loginOutput.getDatabaseMajorVersion());
     setDatabaseMinorVersion(loginOutput.getDatabaseMinorVersion());
@@ -848,15 +863,12 @@ private boolean isSnowflakeAuthenticator() {
         || AuthenticatorType.SNOWFLAKE.name().equalsIgnoreCase(authenticator);
   }
 
-  /**
-   * Returns true If authenticator is EXTERNALBROWSER.
-   *
-   * @return true if authenticator type is EXTERNALBROWSER
-   */
-  boolean isExternalbrowserAuthenticator() {
+  boolean isExternalbrowserOrOAuthFullFlowAuthenticator() {
     Map<SFSessionProperty, Object> connectionPropertiesMap = getConnectionPropertiesMap();
     String authenticator = (String) connectionPropertiesMap.get(SFSessionProperty.AUTHENTICATOR);
-    return AuthenticatorType.EXTERNALBROWSER.name().equalsIgnoreCase(authenticator);
+    return AuthenticatorType.EXTERNALBROWSER.name().equalsIgnoreCase(authenticator)
+        || AuthenticatorType.OAUTH_AUTHORIZATION_CODE.name().equalsIgnoreCase(authenticator)
+        || AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name().equalsIgnoreCase(authenticator);
   }
 
   /**
@@ -906,6 +918,8 @@ synchronized void renewSession(String prevSessionToken)
         .setMasterToken(masterToken)
         .setIdToken(idToken)
         .setMfaToken(mfaToken)
+        .setOauthAccessToken(oauthAccessToken)
+        .setOauthRefreshToken(oauthRefreshToken)
         .setLoginTimeout(loginTimeout)
         .setRetryTimeout(retryTimeout)
         .setDatabaseName(getDatabase())
diff --git a/src/main/java/net/snowflake/client/core/SFSessionProperty.java b/src/main/java/net/snowflake/client/core/SFSessionProperty.java
index ff9eebbfb..093b656a3 100644
--- a/src/main/java/net/snowflake/client/core/SFSessionProperty.java
+++ b/src/main/java/net/snowflake/client/core/SFSessionProperty.java
@@ -29,6 +29,12 @@ public enum SFSessionProperty {
   AUTHENTICATOR("authenticator", false, String.class),
   OKTA_USERNAME("oktausername", false, String.class),
   PRIVATE_KEY("privateKey", false, PrivateKey.class),
+  OAUTH_REDIRECT_URI("oauthRedirectUri", false, String.class),
+  OAUTH_CLIENT_ID("oauthClientID", false, String.class),
+  OAUTH_CLIENT_SECRET("oauthClientSecret", false, String.class),
+  OAUTH_SCOPE("oauthScope", false, String.class),
+  OAUTH_AUTHORIZATION_URL("oauthAuthorizationUrl", false, String.class),
+  OAUTH_TOKEN_REQUEST_URL("oauthTokenRequestUrl", false, String.class),
   WAREHOUSE("warehouse", false, String.class),
   LOGIN_TIMEOUT("loginTimeout", false, Integer.class),
   NETWORK_TIMEOUT("networkTimeout", false, Integer.class),
diff --git a/src/main/java/net/snowflake/client/core/SFStatement.java b/src/main/java/net/snowflake/client/core/SFStatement.java
index 0d0668e27..bcb88da5f 100644
--- a/src/main/java/net/snowflake/client/core/SFStatement.java
+++ b/src/main/java/net/snowflake/client/core/SFStatement.java
@@ -505,8 +505,8 @@ public Object executeHelper(
               // renew the session
               session.renewSession(stmtInput.sessionToken);
             } catch (SnowflakeReauthenticationRequest ex0) {
-              if (session.isExternalbrowserAuthenticator()) {
-                reauthenticate();
+              if (session.isExternalbrowserOrOAuthFullFlowAuthenticator()) {
+                session.open();
               } else {
                 throw ex0;
               }
@@ -695,19 +695,6 @@ public SFBaseResultSet execute(
     return execute(sql, false, parametersBinding, caller, execTimeData);
   }
 
-  private void reauthenticate() throws SFException, SnowflakeSQLException {
-    SFLoginInput input =
-        new SFLoginInput()
-            .setRole(session.getRole())
-            .setWarehouse(session.getWarehouse())
-            .setDatabaseName(session.getDatabase())
-            .setSchemaName(session.getSchema())
-            .setOCSPMode(session.getOCSPMode())
-            .setHttpClientSettingsKey(session.getHttpClientKey());
-
-    session.open();
-  }
-
   /**
    * A helper method to build URL and cancel the SQL for exec
    *
diff --git a/src/main/java/net/snowflake/client/core/SFTrustManager.java b/src/main/java/net/snowflake/client/core/SFTrustManager.java
index 6440ec6c3..ae7e82f2d 100644
--- a/src/main/java/net/snowflake/client/core/SFTrustManager.java
+++ b/src/main/java/net/snowflake/client/core/SFTrustManager.java
@@ -225,7 +225,6 @@ public class SFTrustManager extends X509ExtendedTrustManager {
             .setCacheDirectorySystemProperty(CACHE_DIR_PROP)
             .setCacheDirectoryEnvironmentVariable(CACHE_DIR_ENV)
             .setBaseCacheFileName(CACHE_FILE_NAME)
-            .setCacheExpirationInSeconds(CACHE_EXPIRATION_IN_SECONDS)
             .setCacheFileLockExpirationInSeconds(CACHE_FILE_LOCK_EXPIRATION_IN_SECONDS)
             .setOnlyOwnerPermissions(false)
             .build();
@@ -407,8 +406,8 @@ private static String encodeCacheKey(OcspResponseCacheKey ocsp_cache_key) {
   private static String CertificateIDToString(CertificateID certificateID) {
     return String.format(
         "CertID. NameHash: %s, KeyHash: %s, Serial Number: %s",
-        byteToHexString(certificateID.getIssuerNameHash()),
-        byteToHexString(certificateID.getIssuerKeyHash()),
+        HexUtil.byteToHexString(certificateID.getIssuerNameHash()),
+        HexUtil.byteToHexString(certificateID.getIssuerKeyHash()),
         MessageFormat.format("{0,number,#}", certificateID.getSerialNumber()));
   }
 
@@ -538,23 +537,6 @@ private static void verifySignature(
     }
   }
 
-  /**
-   * Converts Byte array to hex string
-   *
-   * @param bytes a byte array
-   * @return a string in hexadecimal code
-   */
-  private static String byteToHexString(byte[] bytes) {
-    final char[] hexArray = "0123456789ABCDEF".toCharArray();
-    char[] hexChars = new char[bytes.length * 2];
-    for (int j = 0; j < bytes.length; j++) {
-      int v = bytes[j] & 0xFF;
-      hexChars[j * 2] = hexArray[v >>> 4];
-      hexChars[j * 2 + 1] = hexArray[v & 0x0F];
-    }
-    return new String(hexChars);
-  }
-
   /**
    * Gets HttpClient object
    *
@@ -1610,7 +1592,9 @@ public boolean equals(Object obj) {
     public String toString() {
       return String.format(
           "OcspResponseCacheKey: NameHash: %s, KeyHash: %s, SerialNumber: %s",
-          byteToHexString(nameHash), byteToHexString(keyHash), serialNumber.toString());
+          HexUtil.byteToHexString(nameHash),
+          HexUtil.byteToHexString(keyHash),
+          serialNumber.toString());
     }
   }
 
diff --git a/src/main/java/net/snowflake/client/core/SecureStorageAppleManager.java b/src/main/java/net/snowflake/client/core/SecureStorageAppleManager.java
index fb467edcc..bfe7540bf 100644
--- a/src/main/java/net/snowflake/client/core/SecureStorageAppleManager.java
+++ b/src/main/java/net/snowflake/client/core/SecureStorageAppleManager.java
@@ -32,7 +32,7 @@ public SecureStorageStatus setCredential(String host, String user, String type,
       return SecureStorageStatus.SUCCESS;
     }
 
-    String target = SecureStorageManager.convertTarget(host, user, type);
+    String target = SecureStorageManager.buildCredentialsKey(host, user, type);
     byte[] targetBytes = target.getBytes(StandardCharsets.UTF_8);
     byte[] userBytes = user.toUpperCase().getBytes(StandardCharsets.UTF_8);
     byte[] credBytes = cred.getBytes(StandardCharsets.UTF_8);
@@ -92,7 +92,7 @@ public SecureStorageStatus setCredential(String host, String user, String type,
   }
 
   public String getCredential(String host, String user, String type) {
-    String target = SecureStorageManager.convertTarget(host, user, type);
+    String target = SecureStorageManager.buildCredentialsKey(host, user, type);
     byte[] targetBytes = target.getBytes(StandardCharsets.UTF_8);
     byte[] userBytes = user.toUpperCase().getBytes(StandardCharsets.UTF_8);
 
@@ -141,7 +141,7 @@ public String getCredential(String host, String user, String type) {
   }
 
   public SecureStorageStatus deleteCredential(String host, String user, String type) {
-    String target = SecureStorageManager.convertTarget(host, user, type);
+    String target = SecureStorageManager.buildCredentialsKey(host, user, type);
     byte[] targetBytes = target.getBytes(StandardCharsets.UTF_8);
     byte[] userBytes = user.toUpperCase().getBytes(StandardCharsets.UTF_8);
 
diff --git a/src/main/java/net/snowflake/client/core/SecureStorageLinuxManager.java b/src/main/java/net/snowflake/client/core/SecureStorageLinuxManager.java
index d8c44dda3..00a67f372 100644
--- a/src/main/java/net/snowflake/client/core/SecureStorageLinuxManager.java
+++ b/src/main/java/net/snowflake/client/core/SecureStorageLinuxManager.java
@@ -23,14 +23,12 @@
  */
 public class SecureStorageLinuxManager implements SecureStorageManager {
   private static final SFLogger logger = SFLoggerFactory.getLogger(SecureStorageLinuxManager.class);
-  private static final String CACHE_FILE_NAME = "temporary_credential.json";
+  private static final String CACHE_FILE_NAME = "credential_cache_v1.json";
   private static final String CACHE_DIR_PROP = "net.snowflake.jdbc.temporaryCredentialCacheDir";
   private static final String CACHE_DIR_ENV = "SF_TEMPORARY_CREDENTIAL_CACHE_DIR";
-  private static final long CACHE_EXPIRATION_IN_SECONDS = 86400L;
+  private static final String CACHE_FILE_TOKENS_OBJECT_NAME = "tokens";
   private static final long CACHE_FILE_LOCK_EXPIRATION_IN_SECONDS = 60L;
-  private FileCacheManager fileCacheManager;
-
-  private final Map<String, Map<String, String>> localCredCache = new HashMap<>();
+  private final FileCacheManager fileCacheManager;
 
   private SecureStorageLinuxManager() {
     fileCacheManager =
@@ -38,7 +36,6 @@ private SecureStorageLinuxManager() {
             .setCacheDirectorySystemProperty(CACHE_DIR_PROP)
             .setCacheDirectoryEnvironmentVariable(CACHE_DIR_ENV)
             .setBaseCacheFileName(CACHE_FILE_NAME)
-            .setCacheExpirationInSeconds(CACHE_EXPIRATION_IN_SECONDS)
             .setCacheFileLockExpirationInSeconds(CACHE_FILE_LOCK_EXPIRATION_IN_SECONDS)
             .build();
     logger.debug(
@@ -53,78 +50,89 @@ public static SecureStorageLinuxManager getInstance() {
     return SecureStorageLinuxManagerHolder.INSTANCE;
   }
 
-  private ObjectNode localCacheToJson() {
-    ObjectNode res = mapper.createObjectNode();
-    for (Map.Entry<String, Map<String, String>> elem : localCredCache.entrySet()) {
-      String elemHost = elem.getKey();
-      Map<String, String> hostMap = elem.getValue();
-      ObjectNode hostNode = mapper.createObjectNode();
-      for (Map.Entry<String, String> elem0 : hostMap.entrySet()) {
-        hostNode.put(elem0.getKey(), elem0.getValue());
-      }
-      res.set(elemHost, hostNode);
-    }
-    return res;
-  }
-
+  @Override
   public synchronized SecureStorageStatus setCredential(
       String host, String user, String type, String token) {
     if (Strings.isNullOrEmpty(token)) {
       logger.warn("No token provided", false);
       return SecureStorageStatus.SUCCESS;
     }
-
-    localCredCache.computeIfAbsent(host.toUpperCase(), newMap -> new HashMap<>());
-
-    Map<String, String> hostMap = localCredCache.get(host.toUpperCase());
-    hostMap.put(SecureStorageManager.convertTarget(host, user, type), token);
-
-    fileCacheManager.writeCacheFile(localCacheToJson());
+    fileCacheManager.withLock(
+        () -> {
+          Map<String, Map<String, String>> cachedCredentials =
+              readJsonStoreCache(fileCacheManager.readCacheFile());
+          cachedCredentials.computeIfAbsent(
+              CACHE_FILE_TOKENS_OBJECT_NAME, tokensMap -> new HashMap<>());
+          Map<String, String> credentialsMap = cachedCredentials.get(CACHE_FILE_TOKENS_OBJECT_NAME);
+          credentialsMap.put(SecureStorageManager.buildCredentialsKey(host, user, type), token);
+          fileCacheManager.writeCacheFile(
+              SecureStorageLinuxManager.this.localCacheToJson(cachedCredentials));
+          return null;
+        });
     return SecureStorageStatus.SUCCESS;
   }
 
+  @Override
   public synchronized String getCredential(String host, String user, String type) {
-    JsonNode res = fileCacheManager.readCacheFile();
-    readJsonStoreCache(res);
-
-    Map<String, String> hostMap = localCredCache.get(host.toUpperCase());
-
-    if (hostMap == null) {
-      return null;
-    }
-
-    return hostMap.get(SecureStorageManager.convertTarget(host, user, type));
+    return fileCacheManager.withLock(
+        () -> {
+          JsonNode res = fileCacheManager.readCacheFile();
+          Map<String, Map<String, String>> cache = readJsonStoreCache(res);
+          Map<String, String> credentialsMap = cache.get(CACHE_FILE_TOKENS_OBJECT_NAME);
+          if (credentialsMap == null) {
+            return null;
+          }
+          return credentialsMap.get(SecureStorageManager.buildCredentialsKey(host, user, type));
+        });
   }
 
-  /** May delete credentials which doesn't belong to this process */
+  @Override
   public synchronized SecureStorageStatus deleteCredential(String host, String user, String type) {
-    Map<String, String> hostMap = localCredCache.get(host.toUpperCase());
-    if (hostMap != null) {
-      hostMap.remove(SecureStorageManager.convertTarget(host, user, type));
-      if (hostMap.isEmpty()) {
-        localCredCache.remove(host.toUpperCase());
+    fileCacheManager.withLock(
+        () -> {
+          JsonNode res = fileCacheManager.readCacheFile();
+          Map<String, Map<String, String>> cache = readJsonStoreCache(res);
+          Map<String, String> credentialsMap = cache.get(CACHE_FILE_TOKENS_OBJECT_NAME);
+          if (credentialsMap != null) {
+            credentialsMap.remove(SecureStorageManager.buildCredentialsKey(host, user, type));
+            if (credentialsMap.isEmpty()) {
+              cache.remove(CACHE_FILE_TOKENS_OBJECT_NAME);
+            }
+          }
+          fileCacheManager.writeCacheFile(localCacheToJson(cache));
+          return null;
+        });
+    return SecureStorageStatus.SUCCESS;
+  }
+
+  private ObjectNode localCacheToJson(Map<String, Map<String, String>> cache) {
+    ObjectNode jsonNode = mapper.createObjectNode();
+    Map<String, String> tokensMap = cache.get(CACHE_FILE_TOKENS_OBJECT_NAME);
+    if (tokensMap != null) {
+      ObjectNode tokensNode = mapper.createObjectNode();
+      for (Map.Entry<String, String> credential : tokensMap.entrySet()) {
+        tokensNode.put(credential.getKey(), credential.getValue());
       }
+      jsonNode.set(CACHE_FILE_TOKENS_OBJECT_NAME, tokensNode);
     }
-    fileCacheManager.writeCacheFile(localCacheToJson());
-    return SecureStorageStatus.SUCCESS;
+    return jsonNode;
   }
 
-  private void readJsonStoreCache(JsonNode m) {
-    if (m == null || !m.getNodeType().equals(JsonNodeType.OBJECT)) {
+  private Map<String, Map<String, String>> readJsonStoreCache(JsonNode node) {
+    Map<String, Map<String, String>> cache = new HashMap<>();
+    if (node == null || !node.getNodeType().equals(JsonNodeType.OBJECT)) {
       logger.debug("Invalid cache file format.");
-      return;
+      return cache;
     }
-    for (Iterator<Map.Entry<String, JsonNode>> itr = m.fields(); itr.hasNext(); ) {
-      Map.Entry<String, JsonNode> hostMap = itr.next();
-      String host = hostMap.getKey();
-      if (!localCredCache.containsKey(host)) {
-        localCredCache.put(host, new HashMap<>());
-      }
-      JsonNode userJsonNode = hostMap.getValue();
-      for (Iterator<Map.Entry<String, JsonNode>> itr0 = userJsonNode.fields(); itr0.hasNext(); ) {
-        Map.Entry<String, JsonNode> userMap = itr0.next();
-        localCredCache.get(host).put(userMap.getKey(), userMap.getValue().asText());
+    cache.put(CACHE_FILE_TOKENS_OBJECT_NAME, new HashMap<>());
+    JsonNode credentialsNode = node.get(CACHE_FILE_TOKENS_OBJECT_NAME);
+    Map<String, String> credentialsCache = cache.get(CACHE_FILE_TOKENS_OBJECT_NAME);
+    if (credentialsNode != null && node.getNodeType().equals(JsonNodeType.OBJECT)) {
+      for (Iterator<Map.Entry<String, JsonNode>> itr = credentialsNode.fields(); itr.hasNext(); ) {
+        Map.Entry<String, JsonNode> credential = itr.next();
+        credentialsCache.put(credential.getKey(), credential.getValue().asText());
       }
     }
+    return cache;
   }
 }
diff --git a/src/main/java/net/snowflake/client/core/SecureStorageManager.java b/src/main/java/net/snowflake/client/core/SecureStorageManager.java
index d64c26c38..c7b45f30c 100644
--- a/src/main/java/net/snowflake/client/core/SecureStorageManager.java
+++ b/src/main/java/net/snowflake/client/core/SecureStorageManager.java
@@ -4,12 +4,14 @@
 
 package net.snowflake.client.core;
 
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
 /**
  * Interface for accessing Platform specific Local Secure Storage E.g. keychain on Mac credential
  * manager on Windows
  */
 interface SecureStorageManager {
-  String DRIVER_NAME = "SNOWFLAKE-JDBC-DRIVER";
   int COLON_CHAR_LENGTH = 1;
 
   SecureStorageStatus setCredential(String host, String user, String type, String token);
@@ -18,24 +20,23 @@ interface SecureStorageManager {
 
   SecureStorageStatus deleteCredential(String host, String user, String type);
 
-  static String convertTarget(String host, String user, String type) {
+  static String buildCredentialsKey(String host, String user, String type) {
     StringBuilder target =
-        new StringBuilder(
-            host.length()
-                + user.length()
-                + DRIVER_NAME.length()
-                + type.length()
-                + 3 * COLON_CHAR_LENGTH);
+        new StringBuilder(host.length() + user.length() + type.length() + 3 * COLON_CHAR_LENGTH);
 
     target.append(host.toUpperCase());
     target.append(":");
     target.append(user.toUpperCase());
     target.append(":");
-    target.append(DRIVER_NAME);
-    target.append(":");
     target.append(type.toUpperCase());
 
-    return target.toString();
+    try {
+      MessageDigest md = MessageDigest.getInstance("SHA-256");
+      byte[] hash = md.digest(target.toString().getBytes());
+      return HexUtil.byteToHexString(hash);
+    } catch (NoSuchAlgorithmException e) {
+      throw new RuntimeException(e);
+    }
   }
 
   enum SecureStorageStatus {
diff --git a/src/main/java/net/snowflake/client/core/SecureStorageWindowsManager.java b/src/main/java/net/snowflake/client/core/SecureStorageWindowsManager.java
index e47a6d88b..0cf6e5ff5 100644
--- a/src/main/java/net/snowflake/client/core/SecureStorageWindowsManager.java
+++ b/src/main/java/net/snowflake/client/core/SecureStorageWindowsManager.java
@@ -47,7 +47,7 @@ public SecureStorageStatus setCredential(String host, String user, String type,
     Memory credBlobMem = new Memory(credBlob.length);
     credBlobMem.write(0, credBlob, 0, credBlob.length);
 
-    String target = SecureStorageManager.convertTarget(host, user, type);
+    String target = SecureStorageManager.buildCredentialsKey(host, user, type);
 
     SecureStorageWindowsCredential cred = new SecureStorageWindowsCredential();
     cred.Type = SecureStorageWindowsCredentialType.CRED_TYPE_GENERIC.getType();
@@ -76,7 +76,7 @@ public SecureStorageStatus setCredential(String host, String user, String type,
 
   public String getCredential(String host, String user, String type) {
     PointerByReference pCredential = new PointerByReference();
-    String target = SecureStorageManager.convertTarget(host, user, type);
+    String target = SecureStorageManager.buildCredentialsKey(host, user, type);
 
     try {
       boolean ret = false;
@@ -127,7 +127,7 @@ public String getCredential(String host, String user, String type) {
   }
 
   public SecureStorageStatus deleteCredential(String host, String user, String type) {
-    String target = SecureStorageManager.convertTarget(host, user, type);
+    String target = SecureStorageManager.buildCredentialsKey(host, user, type);
 
     boolean ret = false;
     synchronized (advapi32Lib) {
diff --git a/src/main/java/net/snowflake/client/core/SessionUtil.java b/src/main/java/net/snowflake/client/core/SessionUtil.java
index dc3b4969a..fb457f61c 100644
--- a/src/main/java/net/snowflake/client/core/SessionUtil.java
+++ b/src/main/java/net/snowflake/client/core/SessionUtil.java
@@ -5,8 +5,10 @@
 package net.snowflake.client.core;
 
 import static net.snowflake.client.core.SFTrustManager.resetOCSPResponseCacherServerURL;
+import static net.snowflake.client.jdbc.SnowflakeUtil.systemGetEnv;
 import static net.snowflake.client.jdbc.SnowflakeUtil.systemGetProperty;
 
+import com.amazonaws.util.StringUtils;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -29,6 +31,10 @@
 import net.snowflake.client.core.auth.AuthenticatorType;
 import net.snowflake.client.core.auth.ClientAuthnDTO;
 import net.snowflake.client.core.auth.ClientAuthnParameter;
+import net.snowflake.client.core.auth.oauth.AccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthAccessTokenForRefreshTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthAccessTokenProviderFactory;
+import net.snowflake.client.core.auth.oauth.TokenResponseDTO;
 import net.snowflake.client.jdbc.ErrorCode;
 import net.snowflake.client.jdbc.SnowflakeDriver;
 import net.snowflake.client.jdbc.SnowflakeReauthenticationRequest;
@@ -139,6 +145,7 @@ public class SessionUtil {
   public static int DEFAULT_CLIENT_PREFETCH_THREADS = 4;
   public static int MIN_CLIENT_CHUNK_SIZE = 48;
   public static int MAX_CLIENT_CHUNK_SIZE = 160;
+
   public static Map<String, String> JVM_PARAMS_TO_PARAMS =
       Stream.of(
               new String[][] {
@@ -218,9 +225,21 @@ private static AuthenticatorType getAuthenticator(SFLoginInput loginInput) {
           .equalsIgnoreCase(AuthenticatorType.EXTERNALBROWSER.name())) {
         // SAML 2.0 compliant service/application
         return AuthenticatorType.EXTERNALBROWSER;
+      } else if (loginInput
+          .getAuthenticator()
+          .equalsIgnoreCase(AuthenticatorType.OAUTH_AUTHORIZATION_CODE.name())) {
+        return AuthenticatorType.OAUTH_AUTHORIZATION_CODE;
+      } else if (loginInput
+          .getAuthenticator()
+          .equalsIgnoreCase(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name())) {
+        return AuthenticatorType.OAUTH_CLIENT_CREDENTIALS;
       } else if (loginInput.getAuthenticator().equalsIgnoreCase(AuthenticatorType.OAUTH.name())) {
-        // OAuth Authentication
+        // OAuth access code Authentication
         return AuthenticatorType.OAUTH;
+      } else if (loginInput
+          .getAuthenticator()
+          .equalsIgnoreCase(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN.name())) {
+        return AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN;
       } else if (loginInput
           .getAuthenticator()
           .equalsIgnoreCase(AuthenticatorType.SNOWFLAKE_JWT.name())) {
@@ -267,17 +286,18 @@ static SFLoginOutput openSession(
         loginInput.getLoginTimeout() >= 0, "negative login timeout for opening session");
 
     final AuthenticatorType authenticator = getAuthenticator(loginInput);
-    if (!authenticator.equals(AuthenticatorType.OAUTH)) {
-      // OAuth does not require a username
-      AssertUtil.assertTrue(
-          loginInput.getUserName() != null, "missing user name for opening session");
-    } else {
-      // OAUTH needs either token or password
+    checkIfExperimentalAuthnEnabled(authenticator);
+
+    if (isTokenOrPasswordRequired(authenticator)) {
       AssertUtil.assertTrue(
           loginInput.getToken() != null || loginInput.getPassword() != null,
           "missing token or password for opening session");
     }
-    if (authenticator.equals(AuthenticatorType.EXTERNALBROWSER)) {
+    if (isUsernameRequired(authenticator)) {
+      AssertUtil.assertTrue(
+          loginInput.getUserName() != null, "missing user name for opening session");
+    }
+    if (isEligibleForTokenCaching(authenticator)) {
       if ((Constants.getOS() == Constants.OS.MAC || Constants.getOS() == Constants.OS.WINDOWS)
           && loginInput.isEnableClientStoreTemporaryCredential()) {
         // force to set the flag for Mac/Windows users
@@ -308,17 +328,104 @@ static SFLoginOutput openSession(
 
     convertSessionParameterStringValueToBooleanIfGiven(loginInput, CLIENT_REQUEST_MFA_TOKEN);
 
-    preNewSession(loginInput);
+    readCachedTokensIfPossible(loginInput);
+    if (OAuthAccessTokenProviderFactory.isEligible(getAuthenticator(loginInput))) {
+      obtainAuthAccessTokenAndUpdateInput(loginInput);
+    }
 
     try {
       return newSession(loginInput, connectionPropertiesMap, tracingLevel);
     } catch (SnowflakeReauthenticationRequest ex) {
-      // Id Token expired. We run newSession again with id_token cache cleared
-      logger.debug("ID Token being used has expired. Reauthenticating with ID Token cleared...");
+      if (ex.getErrorCode() == Constants.OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) {
+        if (loginInput.getOauthRefreshToken() != null) {
+          refreshOAuthAccessTokenAndUpdateInput(loginInput);
+        } else {
+          loginInput.restoreOriginalAuthenticator();
+          fetchOAuthAccessTokenAndUpdateInput(loginInput);
+        }
+      }
       return newSession(loginInput, connectionPropertiesMap, tracingLevel);
     }
   }
 
+  static void checkIfExperimentalAuthnEnabled(AuthenticatorType authenticator) throws SFException {
+    if (authenticator.equals(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN)
+        || authenticator.equals(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS)
+        || authenticator.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)) {
+      boolean experimentalAuthenticationMethodsEnabled =
+          Boolean.parseBoolean(systemGetEnv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION"));
+      AssertUtil.assertTrue(
+          experimentalAuthenticationMethodsEnabled,
+          "Following authentication method not yet supported: " + authenticator);
+    }
+  }
+
+  private static boolean isEligibleForTokenCaching(AuthenticatorType authenticator) {
+    return authenticator.equals(AuthenticatorType.EXTERNALBROWSER)
+        || authenticator.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)
+        || authenticator.equals(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS);
+  }
+
+  private static boolean isTokenOrPasswordRequired(AuthenticatorType authenticator) {
+    return authenticator.equals(AuthenticatorType.OAUTH)
+        || authenticator.equals(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN);
+  }
+
+  private static boolean isUsernameRequired(AuthenticatorType authenticator) {
+    return !authenticator.equals(AuthenticatorType.OAUTH)
+        && !authenticator.equals(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN)
+        && !authenticator.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)
+        && !authenticator.equals(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS);
+  }
+
+  private static void obtainAuthAccessTokenAndUpdateInput(SFLoginInput loginInput)
+      throws SFException {
+    if (loginInput.getOauthAccessToken() != null) { // Access Token was cached
+      loginInput.setAuthenticator(AuthenticatorType.OAUTH.name());
+      loginInput.setToken(loginInput.getOauthAccessToken());
+    } else { // Access Token not cached
+      fetchOAuthAccessTokenAndUpdateInput(loginInput);
+    }
+  }
+
+  private static void fetchOAuthAccessTokenAndUpdateInput(SFLoginInput loginInput)
+      throws SFException {
+    OAuthAccessTokenProviderFactory accessTokenProviderFactory =
+        new OAuthAccessTokenProviderFactory(
+            new SessionUtilExternalBrowser.DefaultAuthExternalBrowserHandlers(),
+            loginInput.getBrowserResponseTimeout().getSeconds());
+    AccessTokenProvider accessTokenProvider =
+        accessTokenProviderFactory.createAccessTokenProvider(
+            getAuthenticator(loginInput), loginInput);
+    TokenResponseDTO tokenResponse = accessTokenProvider.getAccessToken(loginInput);
+    loginInput.setAuthenticator(AuthenticatorType.OAUTH.name());
+    loginInput.setToken(tokenResponse.getAccessToken());
+    loginInput.setOauthAccessToken(tokenResponse.getAccessToken());
+    loginInput.setOauthRefreshToken(tokenResponse.getRefreshToken());
+  }
+
+  private static void refreshOAuthAccessTokenAndUpdateInput(SFLoginInput loginInput)
+      throws SFException {
+    try {
+      OAuthAccessTokenForRefreshTokenProvider tokenRefresher =
+          new OAuthAccessTokenForRefreshTokenProvider();
+      TokenResponseDTO tokenResponse = tokenRefresher.getAccessToken(loginInput);
+      loginInput.setToken(tokenResponse.getAccessToken());
+      loginInput.setOauthAccessToken(tokenResponse.getAccessToken());
+      loginInput.setAuthenticator(AuthenticatorType.OAUTH.name());
+      if (tokenResponse.getRefreshToken() != null) {
+        loginInput.setOauthRefreshToken(tokenResponse.getRefreshToken());
+      }
+    } catch (SFException | Exception e) {
+      logger.debug(
+          "Refreshing OAuth access token failed. Removing OAuth refresh token from cache and restarting OAuth flow...",
+          e);
+      CredentialManager.deleteOAuthRefreshTokenCache(loginInput);
+      loginInput.restoreOriginalAuthenticator();
+      fetchOAuthAccessTokenAndUpdateInput(loginInput);
+    }
+  }
+
   private static void convertSessionParameterStringValueToBooleanIfGiven(
       SFLoginInput loginInput, String parameterName) {
     Object currentClientRequestMfaToken = loginInput.getSessionParameters().get(parameterName);
@@ -329,13 +436,17 @@ private static void convertSessionParameterStringValueToBooleanIfGiven(
     }
   }
 
-  private static void preNewSession(SFLoginInput loginInput) throws SFException {
-    if (asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
-      CredentialManager.getInstance().fillCachedIdToken(loginInput);
-    }
+  private static void readCachedTokensIfPossible(SFLoginInput loginInput) throws SFException {
+    if (!StringUtils.isNullOrEmpty(loginInput.getUserName())) {
+      if (asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
+        CredentialManager.fillCachedIdToken(loginInput);
+        CredentialManager.fillCachedOAuthAccessToken(loginInput);
+        CredentialManager.fillCachedOAuthRefreshToken(loginInput);
+      }
 
-    if (asBoolean(loginInput.getSessionParameters().get(CLIENT_REQUEST_MFA_TOKEN))) {
-      CredentialManager.getInstance().fillCachedMfaToken(loginInput);
+      if (asBoolean(loginInput.getSessionParameters().get(CLIENT_REQUEST_MFA_TOKEN))) {
+        CredentialManager.fillCachedMfaToken(loginInput);
+      }
     }
   }
 
@@ -352,7 +463,7 @@ private static boolean asBoolean(Object value) {
     return false;
   }
 
-  private static SFLoginOutput newSession(
+  static SFLoginOutput newSession(
       SFLoginInput loginInput,
       Map<SFSessionProperty, Object> connectionPropertiesMap,
       String tracingLevel)
@@ -495,7 +606,8 @@ private static SFLoginOutput newSession(
         }
       } else if (authenticatorType == AuthenticatorType.OKTA) {
         data.put(ClientAuthnParameter.RAW_SAML_RESPONSE.name(), tokenOrSamlResponse);
-      } else if (authenticatorType == AuthenticatorType.OAUTH) {
+      } else if (authenticatorType == AuthenticatorType.OAUTH
+          || authenticatorType == AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN) {
         data.put(ClientAuthnParameter.AUTHENTICATOR.name(), authenticatorType.name());
 
         // Fix for HikariCP refresh token issue:SNOW-533673.
@@ -519,6 +631,12 @@ private static SFLoginOutput newSession(
         }
       }
 
+      // OAuth metrics data
+      if (authenticatorType == AuthenticatorType.OAUTH
+          && loginInput.getOriginalAuthenticator() != null) {
+        data.put(ClientAuthnParameter.OAUTH_TYPE.name(), loginInput.getOriginalAuthenticator());
+      }
+
       // map of client environment parameters, including connection parameters
       // and environment properties like OS version, etc.
       Map<String, Object> clientEnv = new HashMap<>();
@@ -766,11 +884,25 @@ private static SFLoginOutput newSession(
           deleteIdTokenCache(loginInput.getHostFromServerUrl(), loginInput.getUserName());
 
           logger.debug(
-              "ID Token Expired / Not Applicable. Reauthenticating without ID Token...: {}",
+              "ID Token Expired / Not Applicable. Reauthenticating with ID Token cleared...: {}",
               errorCode);
           SnowflakeUtil.checkErrorAndThrowExceptionIncludingReauth(jsonNode);
         }
 
+        if (errorCode == Constants.OAUTH_ACCESS_TOKEN_INVALID_GS_CODE) {
+          logger.debug("OAuth Access Token Invalid: {}", errorCode);
+          loginInput.setOauthAccessToken(null);
+          CredentialManager.deleteOAuthAccessTokenCache(loginInput);
+        }
+
+        if (errorCode == Constants.OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) {
+          loginInput.setOauthAccessToken(null);
+          CredentialManager.deleteOAuthAccessTokenCache(loginInput);
+
+          logger.debug("OAuth Access Token Expired: {}", errorCode);
+          SnowflakeUtil.checkErrorAndThrowExceptionIncludingReauth(jsonNode);
+        }
+
         if (authenticatorType == AuthenticatorType.USERNAME_PASSWORD_MFA) {
           deleteMfaTokenCache(loginInput.getHostFromServerUrl(), loginInput.getUserName());
         }
@@ -894,6 +1026,8 @@ private static SFLoginOutput newSession(
             masterTokenValidityInSeconds,
             idToken,
             mfaToken,
+            loginInput.getOauthAccessToken(),
+            loginInput.getOauthRefreshToken(),
             databaseVersion,
             databaseMajorVersion,
             databaseMinorVersion,
@@ -906,13 +1040,20 @@ private static SFLoginOutput newSession(
             sessionId,
             commonParams);
 
-    if (consentCacheIdToken
-        && asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
-      CredentialManager.getInstance().writeIdToken(loginInput, ret);
+    if (asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
+      if (consentCacheIdToken) {
+        CredentialManager.writeIdToken(loginInput, ret.getIdToken());
+      }
+      if (loginInput.getOauthAccessToken() != null) {
+        CredentialManager.writeOAuthAccessToken(loginInput);
+      }
+      if (loginInput.getOauthRefreshToken() != null) {
+        CredentialManager.writeOAuthRefreshToken(loginInput);
+      }
     }
 
     if (asBoolean(loginInput.getSessionParameters().get(CLIENT_REQUEST_MFA_TOKEN))) {
-      CredentialManager.getInstance().writeMfaToken(loginInput, ret);
+      CredentialManager.writeMfaToken(loginInput, ret.getMfaToken());
     }
 
     stopwatch.stop();
@@ -946,7 +1087,7 @@ private static String nullStringAsEmptyString(String value) {
    * @param user The user
    */
   public static void deleteIdTokenCache(String host, String user) {
-    CredentialManager.getInstance().deleteIdTokenCache(host, user);
+    CredentialManager.deleteIdTokenCache(host, user);
   }
 
   /**
@@ -956,19 +1097,12 @@ public static void deleteIdTokenCache(String host, String user) {
    * @param user The user
    */
   public static void deleteMfaTokenCache(String host, String user) {
-    CredentialManager.getInstance().deleteMfaTokenCache(host, user);
+    CredentialManager.deleteMfaTokenCache(host, user);
   }
 
   /**
    * Renew a session.
    *
-   * <p>Use cases: - Session and Master tokens are provided. No Id token: - succeed in getting a new
-   * Session token. - fail and raise SnowflakeReauthenticationRequest because Master token expires.
-   * Since no id token exists, the exception is thrown to the upstream. - Session and Id tokens are
-   * provided. No Master token: - fail and raise SnowflakeReauthenticationRequest and issue a new
-   * Session token - fail and raise SnowflakeReauthenticationRequest and fail to issue a new Session
-   * token as the
-   *
    * @param loginInput login information
    * @return login output
    * @throws SFException if unexpected uri information
@@ -976,10 +1110,10 @@ public static void deleteMfaTokenCache(String host, String user) {
    */
   static SFLoginOutput renewSession(SFLoginInput loginInput)
       throws SFException, SnowflakeSQLException {
-    return tokenRequest(loginInput, TokenRequestType.RENEW);
+    return renewTokenRequest(loginInput);
   }
 
-  private static SFLoginOutput tokenRequest(SFLoginInput loginInput, TokenRequestType requestType)
+  private static SFLoginOutput renewTokenRequest(SFLoginInput loginInput)
       throws SFException, SnowflakeSQLException {
     AssertUtil.assertTrue(loginInput.getServerUrl() != null, "missing server URL for tokenRequest");
 
@@ -1023,7 +1157,7 @@ private static SFLoginOutput tokenRequest(SFLoginInput loginInput, TokenRequestT
       Map<String, String> payload = new HashMap<>();
       String headerToken = loginInput.getMasterToken();
       payload.put("oldSessionToken", loginInput.getSessionToken());
-      payload.put("requestType", requestType.value);
+      payload.put("requestType", TokenRequestType.RENEW.value);
       String json = mapper.writeValueAsString(payload);
 
       // attach the login info json body to the post request
@@ -1046,7 +1180,7 @@ private static SFLoginOutput tokenRequest(SFLoginInput loginInput, TokenRequestT
 
       logger.debug(
           "Request type: {}, old session token: {}, " + "master token: {}",
-          requestType.value,
+          TokenRequestType.RENEW.value,
           (ArgSupplier) () -> loginInput.getSessionToken() != null ? "******" : null,
           (ArgSupplier) () -> loginInput.getMasterToken() != null ? "******" : null);
 
diff --git a/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java b/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java
index ada33ee2b..ccc47ea48 100644
--- a/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java
+++ b/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java
@@ -62,7 +62,8 @@ public interface AuthExternalBrowserHandlers {
     void output(String msg);
   }
 
-  static class DefaultAuthExternalBrowserHandlers implements AuthExternalBrowserHandlers {
+  @SnowflakeJdbcInternalApi
+  public static class DefaultAuthExternalBrowserHandlers implements AuthExternalBrowserHandlers {
     @Override
     public HttpPost build(URI uri) {
       return new HttpPost(uri);
@@ -81,11 +82,11 @@ public void openBrowser(String ssoUrl) throws SFException {
             && Desktop.getDesktop().isSupported(Desktop.Action.BROWSE)) {
           Desktop.getDesktop().browse(new URI(ssoUrl));
         } else if (os == Constants.OS.MAC) {
-          runtime.exec("open " + ssoUrl);
+          runtime.exec(new String[] {"open", ssoUrl});
         } else if (os == Constants.OS.WINDOWS) {
           runtime.exec(new String[] {"rundll32", "url.dll,FileProtocolHandler", ssoUrl});
         } else {
-          runtime.exec("xdg-open " + ssoUrl);
+          runtime.exec(new String[] {"xdg-open", ssoUrl});
         }
       } catch (URISyntaxException | IOException ex) {
         throw new SFException(ex, ErrorCode.NETWORK_ERROR, ex.getMessage());
diff --git a/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java b/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java
index e25af718a..f22c437e6 100644
--- a/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java
+++ b/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024 Snowflake Computing Inc. All right reserved.
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All right reserved.
  */
 package net.snowflake.client.core.auth;
 
@@ -41,5 +41,20 @@ public enum AuthenticatorType {
   /*
    * Authenticator to enable token for regular login with mfa
    */
-  USERNAME_PASSWORD_MFA
+  USERNAME_PASSWORD_MFA,
+
+  /*
+   * Authorization code flow with browser popup
+   */
+  OAUTH_AUTHORIZATION_CODE,
+
+  /*
+   * Client credentials flow with clientId and clientSecret as input
+   */
+  OAUTH_CLIENT_CREDENTIALS,
+
+  /*
+   * Authenticator to support PAT created in Snowflake
+   */
+  PROGRAMMATIC_ACCESS_TOKEN
 }
diff --git a/src/main/java/net/snowflake/client/core/auth/ClientAuthnParameter.java b/src/main/java/net/snowflake/client/core/auth/ClientAuthnParameter.java
index 8571a013b..95517fd45 100644
--- a/src/main/java/net/snowflake/client/core/auth/ClientAuthnParameter.java
+++ b/src/main/java/net/snowflake/client/core/auth/ClientAuthnParameter.java
@@ -20,5 +20,6 @@ public enum ClientAuthnParameter {
   BROWSER_MODE_REDIRECT_PORT,
   SESSION_PARAMETERS,
   PROOF_KEY,
-  TOKEN
+  TOKEN,
+  OAUTH_TYPE
 }
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/AccessTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/AccessTokenProvider.java
new file mode 100644
index 000000000..bba33e4bd
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/AccessTokenProvider.java
@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+public interface AccessTokenProvider {
+
+  TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException;
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandler.java b/src/main/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandler.java
new file mode 100644
index 000000000..b6e79931d
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandler.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.amazonaws.util.StringUtils;
+import com.google.common.html.HtmlEscapers;
+import com.nimbusds.oauth2.sdk.id.State;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+class AuthorizationCodeRedirectRequestHandler {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(AuthorizationCodeRedirectRequestHandler.class);
+
+  static String handleRedirectRequest(
+      Map<String, String> urlParams,
+      CompletableFuture<String> authorizationCodeFuture,
+      State expectedState) {
+    String response;
+    if (urlParams.containsKey("error")) {
+      response = "Authorization error: " + urlParams.get("error");
+      authorizationCodeFuture.completeExceptionally(
+          new SFException(
+              ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+              String.format(
+                  "Error during authorization: %s, %s",
+                  urlParams.get("error"), urlParams.get("error_description"))));
+    } else if (!expectedState.getValue().equals(urlParams.get("state"))) {
+      authorizationCodeFuture.completeExceptionally(
+          new SFException(
+              ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+              String.format(
+                  "Invalid authorization request redirection state: %s, expected: %s",
+                  urlParams.get("state"), expectedState.getValue())));
+      response = "Authorization error: invalid authorization request redirection state";
+    } else {
+      String authorizationCode = urlParams.get("code");
+      if (!StringUtils.isNullOrEmpty(authorizationCode)) {
+        logger.debug("Received authorization code on redirect URI");
+        response = "Authorization completed successfully.";
+        authorizationCodeFuture.complete(authorizationCode);
+      } else {
+        authorizationCodeFuture.completeExceptionally(
+            new SFException(
+                ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+                String.format(
+                    "Authorization code redirect URI server received request without authorization code; queryParams: %s",
+                    urlParams)));
+        response = "Authorization error: authorization code has not been returned to the driver.";
+      }
+    }
+    return HtmlEscapers.htmlEscaper().escape(response);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenForRefreshTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenForRefreshTokenProvider.java
new file mode 100644
index 000000000..121646aaf
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenForRefreshTokenProvider.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import java.net.URI;
+import net.snowflake.client.core.HttpUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthAccessTokenForRefreshTokenProvider implements AccessTokenProvider {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthClientCredentialsAccessTokenProvider.class);
+
+  private static final ObjectMapper objectMapper = new ObjectMapper();
+
+  @Override
+  public TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException {
+    try {
+      logger.debug("Obtaining new OAuth access token using refresh token...");
+      TokenRequest tokenRequest = buildTokenRequest(loginInput);
+      return requestForAccessToken(loginInput, tokenRequest);
+    } catch (Exception e) {
+      logger.error("Error during OAuth refresh token flow.", e);
+      throw new SFException(e, ErrorCode.OAUTH_REFRESH_TOKEN_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private TokenResponseDTO requestForAccessToken(SFLoginInput loginInput, TokenRequest tokenRequest)
+      throws Exception {
+    URI requestUri = tokenRequest.getEndpointURI();
+    logger.debug(
+        "Requesting new OAuth access token from: {}{}",
+        requestUri.getAuthority(),
+        requestUri.getPath());
+    String tokenResponse =
+        HttpUtil.executeGeneralRequest(
+            OAuthUtil.convertToBaseAuthorizationRequest(tokenRequest.toHTTPRequest()),
+            loginInput.getLoginTimeout(),
+            loginInput.getAuthTimeout(),
+            loginInput.getSocketTimeoutInMillis(),
+            0,
+            loginInput.getHttpClientSettingsKey());
+    TokenResponseDTO tokenResponseDTO =
+        objectMapper.readValue(tokenResponse, TokenResponseDTO.class);
+    logger.debug(
+        "Received new OAuth access token from: {}{}",
+        requestUri.getAuthority(),
+        requestUri.getPath());
+    return tokenResponseDTO;
+  }
+
+  private static TokenRequest buildTokenRequest(SFLoginInput loginInput) {
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput.getOauthLoginInput(), loginInput.getServerUrl());
+    ClientAuthentication clientAuthentication =
+        new ClientSecretBasic(
+            new ClientID(loginInput.getOauthLoginInput().getClientId()),
+            new Secret(loginInput.getOauthLoginInput().getClientSecret()));
+    Scope scope =
+        new Scope(OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole()));
+    RefreshToken refreshToken = new RefreshToken(loginInput.getOauthRefreshToken());
+    return new TokenRequest(
+        tokenRequestUrl, clientAuthentication, new RefreshTokenGrant(refreshToken), scope);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactory.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactory.java
new file mode 100644
index 000000000..c232717be
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactory.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.amazonaws.util.StringUtils;
+import java.net.URI;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+import net.snowflake.client.core.AssertUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SessionUtilExternalBrowser;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthAccessTokenProviderFactory {
+
+  private final SFLogger logger = SFLoggerFactory.getLogger(OAuthAccessTokenProviderFactory.class);
+  private static final Set<AuthenticatorType> ELIGIBLE_AUTH_TYPES =
+      new HashSet<>(
+          Arrays.asList(
+              AuthenticatorType.OAUTH_AUTHORIZATION_CODE,
+              AuthenticatorType.OAUTH_CLIENT_CREDENTIALS));
+
+  private final SessionUtilExternalBrowser.AuthExternalBrowserHandlers browserHandler;
+  private final long browserAuthorizationTimeoutSeconds;
+
+  public OAuthAccessTokenProviderFactory(
+      SessionUtilExternalBrowser.AuthExternalBrowserHandlers browserHandler,
+      long browserAuthorizationTimeoutSeconds) {
+    this.browserHandler = browserHandler;
+    this.browserAuthorizationTimeoutSeconds = browserAuthorizationTimeoutSeconds;
+  }
+
+  public AccessTokenProvider createAccessTokenProvider(
+      AuthenticatorType authenticatorType, SFLoginInput loginInput) throws SFException {
+    switch (authenticatorType) {
+      case OAUTH_AUTHORIZATION_CODE:
+        assertContainsClientCredentials(loginInput, authenticatorType);
+        validateHttpRedirectUriIfSpecified(loginInput);
+        validateAuthorizationAndTokenEndpointsIfSpecified(loginInput);
+        return new OAuthAuthorizationCodeAccessTokenProvider(
+            browserHandler, new RandomStateProvider(), browserAuthorizationTimeoutSeconds);
+      case OAUTH_CLIENT_CREDENTIALS:
+        assertContainsClientCredentials(loginInput, authenticatorType);
+        AssertUtil.assertTrue(
+            loginInput.getOauthLoginInput().getTokenRequestUrl() != null,
+            "passing oauthTokenRequestUrl is required for OAUTH_CLIENT_CREDENTIALS authentication");
+        return new OAuthClientCredentialsAccessTokenProvider();
+      default:
+        String message = "Unsupported authenticator type: " + authenticatorType;
+        logger.error(message);
+        throw new SFException(ErrorCode.INTERNAL_ERROR, message);
+    }
+  }
+
+  private void validateAuthorizationAndTokenEndpointsIfSpecified(SFLoginInput loginInput)
+      throws SFException {
+    String authorizationEndpoint = loginInput.getOauthLoginInput().getAuthorizationUrl();
+    String tokenEndpoint = loginInput.getOauthLoginInput().getTokenRequestUrl();
+    if ((!StringUtils.isNullOrEmpty(authorizationEndpoint)
+            && StringUtils.isNullOrEmpty(tokenEndpoint))
+        || (StringUtils.isNullOrEmpty(authorizationEndpoint)
+            && !StringUtils.isNullOrEmpty(tokenEndpoint))) {
+      throw new SFException(
+          ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+          "For OAUTH_AUTHORIZATION_CODE authentication with external IdP, both oauthAuthorizationUrl and oauthTokenRequestUrl must be specified");
+    } else if (!StringUtils.isNullOrEmpty(authorizationEndpoint)
+        && !StringUtils.isNullOrEmpty(tokenEndpoint)) {
+      URI authorizationUrl = URI.create(authorizationEndpoint);
+      URI tokenUrl = URI.create(tokenEndpoint);
+      if (StringUtils.isNullOrEmpty(authorizationUrl.getHost())
+          || StringUtils.isNullOrEmpty(tokenUrl.getHost())) {
+        throw new SFException(
+            ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+            String.format(
+                "OAuth authorization URL and token URL must be specified in proper format; oauthAuthorizationUrl=%s oauthTokenRequestUrl=%s",
+                authorizationUrl, tokenUrl));
+      }
+      if (!authorizationUrl.getHost().equals(tokenUrl.getHost())) {
+        logger.warn(
+            String.format(
+                "Both oauthAuthorizationUrl and oauthTokenRequestUrl should belong to the same host; oauthAuthorizationUrl=%s oauthTokenRequestUrl=%s",
+                authorizationUrl, tokenUrl));
+      }
+    }
+  }
+
+  private void validateHttpRedirectUriIfSpecified(SFLoginInput loginInput) throws SFException {
+    String redirectUri = loginInput.getOauthLoginInput().getRedirectUri();
+    if (redirectUri != null) {
+      AssertUtil.assertTrue(
+          !redirectUri.startsWith("https"),
+          "provided redirect URI should start with \"http\", not \"https\"");
+    }
+  }
+
+  public static boolean isEligible(AuthenticatorType authenticatorType) {
+    return getEligible().contains(authenticatorType);
+  }
+
+  private static Set<AuthenticatorType> getEligible() {
+    return ELIGIBLE_AUTH_TYPES;
+  }
+
+  private void assertContainsClientCredentials(
+      SFLoginInput loginInput, AuthenticatorType authenticatorType) throws SFException {
+    AssertUtil.assertTrue(
+        loginInput.getOauthLoginInput().getClientId() != null,
+        String.format(
+            "passing oauthClientId is required for %s authentication", authenticatorType.name()));
+    AssertUtil.assertTrue(
+        loginInput.getOauthLoginInput().getClientSecret() != null,
+        String.format(
+            "passing oauthClientSecret is required for %s authentication",
+            authenticatorType.name()));
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAuthorizationCodeAccessTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAuthorizationCodeAccessTokenProvider.java
new file mode 100644
index 000000000..48a6f41ce
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAuthorizationCodeAccessTokenProvider.java
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import static net.snowflake.client.core.SessionUtilExternalBrowser.AuthExternalBrowserHandlers;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.AuthorizationCode;
+import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
+import com.nimbusds.oauth2.sdk.AuthorizationGrant;
+import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.ResponseType;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.id.State;
+import com.nimbusds.oauth2.sdk.pkce.CodeChallengeMethod;
+import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.stream.Collectors;
+import net.snowflake.client.core.HttpUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SFOauthLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.utils.URLEncodedUtils;
+
+@SnowflakeJdbcInternalApi
+public class OAuthAuthorizationCodeAccessTokenProvider implements AccessTokenProvider {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthAuthorizationCodeAccessTokenProvider.class);
+
+  static final String DEFAULT_REDIRECT_HOST = "http://127.0.0.1";
+  static final String DEFAULT_REDIRECT_URI_ENDPOINT = "/";
+  private static final ObjectMapper objectMapper = new ObjectMapper();
+
+  private final AuthExternalBrowserHandlers browserHandler;
+  private final StateProvider<String> stateProvider;
+  private final long browserAuthorizationTimeoutSeconds;
+
+  public OAuthAuthorizationCodeAccessTokenProvider(
+      AuthExternalBrowserHandlers browserHandler,
+      StateProvider<String> stateProvider,
+      long browserAuthorizationTimeoutSeconds) {
+    this.browserHandler = browserHandler;
+    this.stateProvider = stateProvider;
+    this.browserAuthorizationTimeoutSeconds = browserAuthorizationTimeoutSeconds;
+  }
+
+  @Override
+  public TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException {
+    try {
+      logger.debug("Starting OAuth authorization code authentication flow...");
+      CodeVerifier pkceVerifier = new CodeVerifier();
+      URI redirectUri = OAuthUtil.buildRedirectUri(loginInput.getOauthLoginInput());
+      AuthorizationCode authorizationCode =
+          requestAuthorizationCode(loginInput, pkceVerifier, redirectUri);
+      return exchangeAuthorizationCodeForAccessToken(
+          loginInput, authorizationCode, pkceVerifier, redirectUri);
+    } catch (Exception e) {
+      logger.error(
+          "Error during OAuth authorization code flow. Verify configuration passed to driver and IdP (URLs, grant types, scope, etc.)",
+          e);
+      throw new SFException(e, ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private AuthorizationCode requestAuthorizationCode(
+      SFLoginInput loginInput, CodeVerifier pkceVerifier, URI redirectUri)
+      throws SFException, IOException {
+    State state = new State(stateProvider.getState());
+    AuthorizationRequest request =
+        buildAuthorizationRequest(loginInput, pkceVerifier, state, redirectUri);
+    URI authorizeRequestURI = request.toURI();
+    HttpServer httpServer = createHttpServer(redirectUri);
+    CompletableFuture<String> codeFuture =
+        setupRedirectURIServerForAuthorizationCode(httpServer, state);
+    logger.debug("Waiting for authorization code redirection to {}...", redirectUri);
+    return letUserAuthorize(authorizeRequestURI, codeFuture, httpServer);
+  }
+
+  private TokenResponseDTO exchangeAuthorizationCodeForAccessToken(
+      SFLoginInput loginInput,
+      AuthorizationCode authorizationCode,
+      CodeVerifier pkceVerifier,
+      URI redirectUri)
+      throws SFException {
+    try {
+      TokenRequest request =
+          buildTokenRequest(loginInput, authorizationCode, pkceVerifier, redirectUri);
+      URI requestUri = request.getEndpointURI();
+      logger.debug(
+          "Requesting OAuth access token from: {}",
+          requestUri.getAuthority() + requestUri.getPath());
+      String tokenResponse =
+          HttpUtil.executeGeneralRequest(
+              OAuthUtil.convertToBaseAuthorizationRequest(request.toHTTPRequest()),
+              loginInput.getLoginTimeout(),
+              loginInput.getAuthTimeout(),
+              loginInput.getSocketTimeoutInMillis(),
+              0,
+              loginInput.getHttpClientSettingsKey());
+      TokenResponseDTO tokenResponseDTO =
+          objectMapper.readValue(tokenResponse, TokenResponseDTO.class);
+      logger.debug(
+          "Received OAuth access token from: {}{}",
+          requestUri.getAuthority(),
+          requestUri.getPath());
+      return tokenResponseDTO;
+    } catch (Exception e) {
+      logger.error("Error during making OAuth access token request", e);
+      throw new SFException(e, ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private AuthorizationCode letUserAuthorize(
+      URI authorizeRequestURI, CompletableFuture<String> codeFuture, HttpServer httpServer)
+      throws SFException {
+    try {
+      logger.debug(
+          "Opening browser for authorization code request to: {}",
+          authorizeRequestURI.getAuthority() + authorizeRequestURI.getPath());
+      browserHandler.openBrowser(authorizeRequestURI.toString());
+      String code = codeFuture.get(this.browserAuthorizationTimeoutSeconds, TimeUnit.SECONDS);
+      return new AuthorizationCode(code);
+    } catch (TimeoutException e) {
+      throw new SFException(
+          e,
+          ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+          "Authorization request timed out. Snowflake driver did not receive authorization code back to the redirect URI. Verify your security integration and driver configuration.");
+    } catch (Exception e) {
+      throw new SFException(e, ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR, e.getMessage());
+    } finally {
+      logger.debug("Stopping OAuth redirect URI server @ {}", httpServer.getAddress());
+      httpServer.stop(1);
+    }
+  }
+
+  private static CompletableFuture<String> setupRedirectURIServerForAuthorizationCode(
+      HttpServer httpServer, State expectedState) {
+    CompletableFuture<String> authorizationCodeFuture = new CompletableFuture<>();
+    httpServer.createContext(
+        DEFAULT_REDIRECT_URI_ENDPOINT,
+        exchange -> {
+          Map<String, String> urlParams =
+              URLEncodedUtils.parse(exchange.getRequestURI(), StandardCharsets.UTF_8).stream()
+                  .collect(Collectors.toMap(NameValuePair::getName, NameValuePair::getValue));
+          String response =
+              AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+                  urlParams, authorizationCodeFuture, expectedState);
+          exchange.sendResponseHeaders(200, response.length());
+          exchange.getResponseBody().write(response.getBytes(StandardCharsets.UTF_8));
+          exchange.getResponseBody().close();
+        });
+    logger.debug("Starting OAuth redirect URI server @ {}", httpServer.getAddress());
+    httpServer.start();
+    return authorizationCodeFuture;
+  }
+
+  private static HttpServer createHttpServer(URI redirectUri) throws IOException {
+    return HttpServer.create(
+        new InetSocketAddress(redirectUri.getHost(), redirectUri.getPort()), 0);
+  }
+
+  private static AuthorizationRequest buildAuthorizationRequest(
+      SFLoginInput loginInput, CodeVerifier pkceVerifier, State state, URI redirectUri) {
+    SFOauthLoginInput oauthLoginInput = loginInput.getOauthLoginInput();
+    ClientID clientID = new ClientID(oauthLoginInput.getClientId());
+    String scope = OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole());
+    return new AuthorizationRequest.Builder(new ResponseType(ResponseType.Value.CODE), clientID)
+        .scope(new Scope(scope))
+        .state(state)
+        .redirectionURI(redirectUri)
+        .codeChallenge(pkceVerifier, CodeChallengeMethod.S256)
+        .endpointURI(
+            OAuthUtil.getAuthorizationUrl(
+                loginInput.getOauthLoginInput(), loginInput.getServerUrl()))
+        .build();
+  }
+
+  private static TokenRequest buildTokenRequest(
+      SFLoginInput loginInput,
+      AuthorizationCode authorizationCode,
+      CodeVerifier pkceVerifier,
+      URI redirectUri) {
+    AuthorizationGrant codeGrant =
+        new AuthorizationCodeGrant(authorizationCode, redirectUri, pkceVerifier);
+    ClientAuthentication clientAuthentication =
+        new ClientSecretBasic(
+            new ClientID(loginInput.getOauthLoginInput().getClientId()),
+            new Secret(loginInput.getOauthLoginInput().getClientSecret()));
+    Scope scope =
+        new Scope(OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole()));
+    return new TokenRequest(
+        OAuthUtil.getTokenRequestUrl(loginInput.getOauthLoginInput(), loginInput.getServerUrl()),
+        clientAuthentication,
+        codeGrant,
+        scope);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthClientCredentialsAccessTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthClientCredentialsAccessTokenProvider.java
new file mode 100644
index 000000000..5fe239917
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthClientCredentialsAccessTokenProvider.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.ClientCredentialsGrant;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import java.net.URI;
+import net.snowflake.client.core.HttpUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthClientCredentialsAccessTokenProvider implements AccessTokenProvider {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthClientCredentialsAccessTokenProvider.class);
+
+  private static final ObjectMapper objectMapper = new ObjectMapper();
+
+  @Override
+  public TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException {
+    try {
+      logger.debug("Starting OAuth authorization code authentication flow...");
+      TokenRequest tokenRequest = buildTokenRequest(loginInput);
+      return requestForAccessToken(loginInput, tokenRequest);
+    } catch (Exception e) {
+      logger.error(
+          "Error during OAuth client credentials code flow. Verify configuration passed to driver and IdP (URLs, grant types, scope, etc.)",
+          e);
+      throw new SFException(e, ErrorCode.OAUTH_CLIENT_CREDENTIALS_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private TokenResponseDTO requestForAccessToken(SFLoginInput loginInput, TokenRequest tokenRequest)
+      throws Exception {
+    URI requestUri = tokenRequest.getEndpointURI();
+    logger.debug(
+        "Requesting OAuth access token from: {}{}",
+        requestUri.getAuthority(),
+        requestUri.getPath());
+    String tokenResponse =
+        HttpUtil.executeGeneralRequest(
+            OAuthUtil.convertToBaseAuthorizationRequest(tokenRequest.toHTTPRequest()),
+            loginInput.getLoginTimeout(),
+            loginInput.getAuthTimeout(),
+            loginInput.getSocketTimeoutInMillis(),
+            0,
+            loginInput.getHttpClientSettingsKey());
+    TokenResponseDTO tokenResponseDTO =
+        objectMapper.readValue(tokenResponse, TokenResponseDTO.class);
+    logger.debug(
+        "Received OAuth access token from: {}", requestUri.getAuthority() + requestUri.getPath());
+    return tokenResponseDTO;
+  }
+
+  private static TokenRequest buildTokenRequest(SFLoginInput loginInput) {
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput.getOauthLoginInput(), loginInput.getServerUrl());
+    ClientAuthentication clientAuthentication =
+        new ClientSecretBasic(
+            new ClientID(loginInput.getOauthLoginInput().getClientId()),
+            new Secret(loginInput.getOauthLoginInput().getClientSecret()));
+    Scope scope =
+        new Scope(OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole()));
+    return new TokenRequest(
+        tokenRequestUrl, clientAuthentication, new ClientCredentialsGrant(), scope);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthUtil.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthUtil.java
new file mode 100644
index 000000000..9b4f183e7
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthUtil.java
@@ -0,0 +1,69 @@
+package net.snowflake.client.core.auth.oauth;
+
+import static net.snowflake.client.core.auth.oauth.OAuthAuthorizationCodeAccessTokenProvider.DEFAULT_REDIRECT_HOST;
+import static net.snowflake.client.core.auth.oauth.OAuthAuthorizationCodeAccessTokenProvider.DEFAULT_REDIRECT_URI_ENDPOINT;
+
+import com.amazonaws.util.StringUtils;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import net.snowflake.client.core.SFOauthLoginInput;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpRequestBase;
+import org.apache.http.entity.StringEntity;
+
+class OAuthUtil {
+
+  private static final String SNOWFLAKE_AUTHORIZE_ENDPOINT = "/oauth/authorize";
+  private static final String SNOWFLAKE_TOKEN_REQUEST_ENDPOINT = "/oauth/token-request";
+
+  private static final String DEFAULT_SESSION_ROLE_SCOPE_PREFIX = "session:role:";
+
+  static URI getTokenRequestUrl(SFOauthLoginInput oauthLoginInput, String serverUrl) {
+    URI uri =
+        !StringUtils.isNullOrEmpty(oauthLoginInput.getTokenRequestUrl())
+            ? URI.create(oauthLoginInput.getTokenRequestUrl())
+            : URI.create(serverUrl + SNOWFLAKE_TOKEN_REQUEST_ENDPOINT);
+    return uri.normalize();
+  }
+
+  static HttpRequestBase convertToBaseAuthorizationRequest(HTTPRequest request) {
+    HttpPost baseRequest = new HttpPost(request.getURI());
+    baseRequest.setEntity(new StringEntity(request.getBody(), StandardCharsets.UTF_8));
+    request
+        .getHeaderMap()
+        .forEach((key, values) -> values.forEach(value -> baseRequest.addHeader(key, value)));
+    return baseRequest;
+  }
+
+  static URI getAuthorizationUrl(SFOauthLoginInput oauthLoginInput, String serverUrl) {
+    URI uri =
+        !StringUtils.isNullOrEmpty(oauthLoginInput.getAuthorizationUrl())
+            ? URI.create(oauthLoginInput.getAuthorizationUrl())
+            : URI.create(serverUrl + SNOWFLAKE_AUTHORIZE_ENDPOINT);
+    return uri.normalize();
+  }
+
+  static String getScope(SFOauthLoginInput oauthLoginInput, String role) {
+    return (!StringUtils.isNullOrEmpty(oauthLoginInput.getScope()))
+        ? oauthLoginInput.getScope()
+        : DEFAULT_SESSION_ROLE_SCOPE_PREFIX + role;
+  }
+
+  static URI buildRedirectUri(SFOauthLoginInput oauthLoginInput) throws IOException {
+    String redirectUri =
+        !StringUtils.isNullOrEmpty(oauthLoginInput.getRedirectUri())
+            ? oauthLoginInput.getRedirectUri()
+            : createDefaultRedirectUri();
+    return URI.create(redirectUri);
+  }
+
+  private static String createDefaultRedirectUri() throws IOException {
+    try (ServerSocket socket = new ServerSocket(0)) {
+      return String.format(
+          "%s:%s%s", DEFAULT_REDIRECT_HOST, socket.getLocalPort(), DEFAULT_REDIRECT_URI_ENDPOINT);
+    }
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/RandomStateProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/RandomStateProvider.java
new file mode 100644
index 000000000..c5cbe15ec
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/RandomStateProvider.java
@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.nimbusds.oauth2.sdk.id.State;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+public class RandomStateProvider implements StateProvider<String> {
+
+  private static final int STATE_BYTE_SIZE = 256;
+
+  @Override
+  public String getState() {
+    return new State(STATE_BYTE_SIZE).getValue();
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/StateProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/StateProvider.java
new file mode 100644
index 000000000..6e8fc8a99
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/StateProvider.java
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+public interface StateProvider<T> {
+  T getState();
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/TokenResponseDTO.java b/src/main/java/net/snowflake/client/core/auth/oauth/TokenResponseDTO.java
new file mode 100644
index 000000000..e0cd3eb1c
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/TokenResponseDTO.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class TokenResponseDTO {
+
+  private final String accessToken;
+  private final String refreshToken;
+  private final String tokenType;
+  private final String scope;
+  private final String username;
+  private final boolean idpInitiated;
+  private final long expiresIn;
+  private final long refreshTokenExpiresIn;
+
+  @JsonCreator(mode = JsonCreator.Mode.PROPERTIES)
+  public TokenResponseDTO(
+      @JsonProperty(value = "access_token", required = true) String accessToken,
+      @JsonProperty("refresh_token") String refreshToken,
+      @JsonProperty("token_type") String tokenType,
+      @JsonProperty("scope") String scope,
+      @JsonProperty("username") String username,
+      @JsonProperty("idp_initiated") boolean idpInitiated,
+      @JsonProperty("expires_in") long expiresIn,
+      @JsonProperty("refresh_token_expires_in") long refreshTokenExpiresIn) {
+    this.accessToken = accessToken;
+    this.tokenType = tokenType;
+    this.refreshToken = refreshToken;
+    this.scope = scope;
+    this.username = username;
+    this.idpInitiated = idpInitiated;
+    this.expiresIn = expiresIn;
+    this.refreshTokenExpiresIn = refreshTokenExpiresIn;
+  }
+
+  public String getAccessToken() {
+    return accessToken;
+  }
+
+  public String getTokenType() {
+    return tokenType;
+  }
+
+  public String getRefreshToken() {
+    return refreshToken;
+  }
+
+  public String getScope() {
+    return scope;
+  }
+
+  public long getExpiresIn() {
+    return expiresIn;
+  }
+
+  public String getUsername() {
+    return username;
+  }
+
+  public long getRefreshTokenExpiresIn() {
+    return refreshTokenExpiresIn;
+  }
+
+  public boolean isIdpInitiated() {
+    return idpInitiated;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/jdbc/ErrorCode.java b/src/main/java/net/snowflake/client/jdbc/ErrorCode.java
index 09fefbd95..b1d030e48 100644
--- a/src/main/java/net/snowflake/client/jdbc/ErrorCode.java
+++ b/src/main/java/net/snowflake/client/jdbc/ErrorCode.java
@@ -87,7 +87,10 @@ public enum ErrorCode {
   DISABLEOCSP_INSECUREMODE_VALUE_MISMATCH(200064, SqlState.INVALID_PARAMETER_VALUE),
   TOO_MANY_FILES_TO_DOWNLOAD_AS_STREAM(200065, SqlState.DATA_EXCEPTION),
   FILE_OPERATION_UPLOAD_ERROR(200066, SqlState.INTERNAL_ERROR),
-  FILE_OPERATION_DOWNLOAD_ERROR(200067, SqlState.INTERNAL_ERROR);
+  FILE_OPERATION_DOWNLOAD_ERROR(200067, SqlState.INTERNAL_ERROR),
+  OAUTH_AUTHORIZATION_CODE_FLOW_ERROR(200068, SqlState.CONNECTION_EXCEPTION),
+  OAUTH_CLIENT_CREDENTIALS_FLOW_ERROR(200069, SqlState.CONNECTION_EXCEPTION),
+  OAUTH_REFRESH_TOKEN_FLOW_ERROR(200070, SqlState.CONNECTION_EXCEPTION);
 
   public static final String errorMessageResource = "net.snowflake.client.jdbc.jdbc_error_messages";
 
diff --git a/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java b/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java
index e40044e59..6dae952eb 100644
--- a/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java
+++ b/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java
@@ -5,6 +5,7 @@
 package net.snowflake.client.jdbc;
 
 import static java.util.Arrays.stream;
+import static net.snowflake.client.core.Constants.OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE;
 import static net.snowflake.client.jdbc.SnowflakeType.GEOGRAPHY;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
@@ -180,6 +181,7 @@ private static void checkErrorAndThrowExceptionSub(
         case MASTER_EXPIRED_GS_CODE:
         case MASTER_TOKEN_INVALID_GS_CODE:
         case ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE:
+        case OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE:
           throw new SnowflakeReauthenticationRequest(queryId, errorMessage, sqlState, errorCode);
       }
     }
diff --git a/src/main/java/net/snowflake/client/util/SecretDetector.java b/src/main/java/net/snowflake/client/util/SecretDetector.java
index 3c0727de7..61fddc010 100644
--- a/src/main/java/net/snowflake/client/util/SecretDetector.java
+++ b/src/main/java/net/snowflake/client/util/SecretDetector.java
@@ -19,6 +19,7 @@
 import net.minidev.json.JSONArray;
 import net.minidev.json.JSONObject;
 import net.minidev.json.JSONStyle;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
 
 /** Search for credentials in sql and/or other text */
 public class SecretDetector {
@@ -34,6 +35,14 @@ public class SecretDetector {
           "(accessToken|tempToken|keySecret)\"\\s*:\\s*\"([a-z0-9/+]{32,}={0,2})\"",
           Pattern.CASE_INSENSITIVE);
 
+  // Used for detecting OAuth tokens in serialized JSON
+  private static final Pattern OAUTH_JSON_PATTERN =
+      Pattern.compile(
+          "(access_token|refresh_token)\""
+              + "\\s*:\\s*"
+              + "\"([a-zA-Z0-9!\"#$%&'\\()*+,-./:;<=>?@\\[\\]^_`\\{|\\}~]{3,})\"",
+          Pattern.CASE_INSENSITIVE);
+
   // Signature added in the query string of a URL in SAS based authentication
   // for S3 or Azure Storage requests
   private static final Pattern SAS_TOKEN_PATTERN =
@@ -88,6 +97,10 @@ public class SecretDetector {
     "sig",
     "signature",
     "temptoken",
+    "oauthClientId",
+    "oauthClientSecret",
+    "accessToken",
+    "refreshToken"
   };
 
   private static Set<String> SENSITIVE_NAME_SET = new HashSet<>(Arrays.asList(SENSITIVE_NAMES));
@@ -113,7 +126,7 @@ public static boolean isSensitive(String name) {
   private static boolean isSensitiveParameter(String name) {
     Pattern PASSWORD_IN_NAME =
         Pattern.compile(
-            ".*?(password|pwd|token|proxyuser|privatekey|passcode|proxypassword|private_key_base).*?",
+            ".*?(password|pwd|token|proxyuser|privatekey|passcode|proxypassword|private_key_base|oauthClientSecret|oauthClientId).*?",
             Pattern.CASE_INSENSITIVE);
     Matcher matcher = PASSWORD_IN_NAME.matcher(name);
     return isSensitive(name) || matcher.matches();
@@ -208,7 +221,26 @@ public static String maskSASToken(String text) {
    */
   public static String maskSecrets(String text) {
     return filterAccessTokens(
-        filterConnectionTokens(filterPassword(filterSASTokens(filterAWSKeys(text)))));
+        filterConnectionTokens(
+            filterPassword(filterSASTokens(filterAWSKeys(filterOAuthTokens(text))))));
+  }
+
+  /**
+   * Masks any secrets present in the OAuth token request JSON response.
+   *
+   * @param text Text which may contain secrets
+   * @return Masked string
+   */
+  @SnowflakeJdbcInternalApi
+  public static String filterOAuthTokens(String text) {
+    Matcher matcher =
+        OAUTH_JSON_PATTERN.matcher(
+            text.length() <= MAX_LENGTH ? text : text.substring(0, MAX_LENGTH));
+
+    if (matcher.find()) {
+      return matcher.replaceAll("$1\":\"****\"");
+    }
+    return text;
   }
 
   /**
diff --git a/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties b/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties
index 5e59df8dc..c3a74d694 100644
--- a/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties
+++ b/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties
@@ -86,3 +86,6 @@ Error message={3}, Extended error info={4}
 200065=Too many files to download as stream
 200066=JDBC driver file operation error while performing stage upload.
 200067=JDBC driver file operation error while performing stage download.
+200068=Error during OAuth Authorization Code authentication: {0}
+200069=Error during OAuth Client Credentials authentication: {0}
+200070=Error during obtaining OAuth access token using refresh token: {0}
diff --git a/src/test/java/net/snowflake/client/core/CredentialManagerTest.java b/src/test/java/net/snowflake/client/core/CredentialManagerTest.java
new file mode 100644
index 000000000..789830786
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/CredentialManagerTest.java
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class CredentialManagerTest {
+
+  public static final String SNOWFLAKE_HOST = "some-account.us-west-2.aws.snowflakecomputing.com";
+  public static final String EXTERNAL_OAUTH_HOST = "some-external-oauth-host.com";
+  public static final String SOME_ACCESS_TOKEN = "some-oauth-access-token";
+  public static final String SOME_REFRESH_TOKEN = "some-refresh-token";
+  public static final String SOME_ID_TOKEN_FROM_CACHE = "some-id-token";
+  public static final String SOME_MFA_TOKEN_FROM_CACHE = "some-mfa-token";
+  public static final String SOME_USER = "some-user";
+
+  public static final String ACCESS_TOKEN_FROM_CACHE = "access-token-from-cache";
+  public static final String REFRESH_TOKEN_FROM_CACHE = "refresh-token-from-cache";
+  public static final String EXTERNAL_ACCESS_TOKEN_FROM_CACHE = "external-access-token-from-cache";
+  public static final String EXTERNAL_REFRESH_TOKEN_FROM_CACHE =
+      "external-refresh-token-from-cache";
+
+  private static final SecureStorageManager mockSecureStorageManager =
+      mock(SecureStorageManager.class);
+
+  @BeforeAll
+  public static void setUp() {
+    CredentialManager.injectSecureStorageManager(mockSecureStorageManager);
+  }
+
+  @AfterAll
+  public static void tearDown() {
+    CredentialManager.resetSecureStorageManager();
+  }
+
+  @Test
+  public void shouldCreateHostBasedOnExternalIdpUrl() throws SFException {
+    SFLoginInput loginInput = createLoginInputWithExternalOAuth();
+    String host = CredentialManager.getHostForOAuthCacheKey(loginInput);
+    assertEquals(EXTERNAL_OAUTH_HOST, host);
+  }
+
+  @Test
+  public void shouldCreateHostBasedOnSnowflakeServerUrl() throws SFException {
+    SFLoginInput loginInput = createLoginInputWithSnowflakeServer();
+    String host = CredentialManager.getHostForOAuthCacheKey(loginInput);
+    assertEquals(SNOWFLAKE_HOST, host);
+  }
+
+  @Test
+  public void shouldProperlyWriteTokensToCache() throws SFException {
+    SFLoginInput loginInputSnowflakeOAuth = createLoginInputWithSnowflakeServer();
+    CredentialManager.writeIdToken(loginInputSnowflakeOAuth, SOME_ID_TOKEN_FROM_CACHE);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.ID_TOKEN.getValue(),
+            SOME_ID_TOKEN_FROM_CACHE);
+    CredentialManager.writeMfaToken(loginInputSnowflakeOAuth, SOME_MFA_TOKEN_FROM_CACHE);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.MFA_TOKEN.getValue(),
+            SOME_MFA_TOKEN_FROM_CACHE);
+
+    CredentialManager.writeOAuthAccessToken(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue(),
+            SOME_ACCESS_TOKEN);
+    CredentialManager.writeOAuthRefreshToken(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue(),
+            SOME_REFRESH_TOKEN);
+
+    SFLoginInput loginInputExternalOAuth = createLoginInputWithExternalOAuth();
+    CredentialManager.writeOAuthAccessToken(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            EXTERNAL_OAUTH_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue(),
+            SOME_ACCESS_TOKEN);
+    CredentialManager.writeOAuthRefreshToken(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            EXTERNAL_OAUTH_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue(),
+            SOME_REFRESH_TOKEN);
+  }
+
+  @Test
+  public void shouldProperlyDeleteTokensFromCache() throws SFException {
+    SFLoginInput loginInputSnowflakeOAuth = createLoginInputWithSnowflakeServer();
+    CredentialManager.deleteIdTokenCache(
+        loginInputSnowflakeOAuth.getHostFromServerUrl(), loginInputSnowflakeOAuth.getUserName());
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.ID_TOKEN.getValue());
+    CredentialManager.deleteMfaTokenCache(
+        loginInputSnowflakeOAuth.getHostFromServerUrl(), loginInputSnowflakeOAuth.getUserName());
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.MFA_TOKEN.getValue());
+
+    CredentialManager.deleteOAuthAccessTokenCache(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue());
+    CredentialManager.deleteOAuthRefreshTokenCache(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue());
+
+    SFLoginInput loginInputExternalOAuth = createLoginInputWithExternalOAuth();
+    CredentialManager.deleteOAuthAccessTokenCache(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue());
+    CredentialManager.deleteOAuthRefreshTokenCache(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue());
+  }
+
+  @Test
+  public void shouldProperlyUpdateInputWithTokensFromCache() throws SFException {
+    SFLoginInput loginInputSnowflakeOAuth = createLoginInputWithSnowflakeServer();
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.ID_TOKEN.getValue()))
+        .thenReturn(SOME_ID_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedIdToken(loginInputSnowflakeOAuth);
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.MFA_TOKEN.getValue()))
+        .thenReturn(SOME_MFA_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedMfaToken(loginInputSnowflakeOAuth);
+    assertEquals(SOME_ID_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getIdToken());
+    assertEquals(SOME_MFA_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getMfaToken());
+
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue()))
+        .thenReturn(ACCESS_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthAccessToken(loginInputSnowflakeOAuth);
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue()))
+        .thenReturn(REFRESH_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthRefreshToken(loginInputSnowflakeOAuth);
+    assertEquals(ACCESS_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getOauthAccessToken());
+    assertEquals(REFRESH_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getOauthRefreshToken());
+
+    SFLoginInput loginInputExternalOAuth = createLoginInputWithExternalOAuth();
+    when(mockSecureStorageManager.getCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue()))
+        .thenReturn(EXTERNAL_ACCESS_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthAccessToken(loginInputExternalOAuth);
+    when(mockSecureStorageManager.getCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue()))
+        .thenReturn(EXTERNAL_REFRESH_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthRefreshToken(loginInputExternalOAuth);
+    assertEquals(EXTERNAL_ACCESS_TOKEN_FROM_CACHE, loginInputExternalOAuth.getOauthAccessToken());
+    assertEquals(EXTERNAL_REFRESH_TOKEN_FROM_CACHE, loginInputExternalOAuth.getOauthRefreshToken());
+  }
+
+  private SFLoginInput createLoginInputWithExternalOAuth() {
+    SFLoginInput loginInput = createGenericLoginInput();
+    loginInput.setOauthLoginInput(
+        new SFOauthLoginInput(
+            null, null, null, null, "https://some-external-oauth-host.com/oauth/token", null));
+    return loginInput;
+  }
+
+  private SFLoginInput createLoginInputWithSnowflakeServer() {
+    SFLoginInput loginInput = createGenericLoginInput();
+    loginInput.setOauthLoginInput(new SFOauthLoginInput(null, null, null, null, null, null));
+    loginInput.setServerUrl("https://some-account.us-west-2.aws.snowflakecomputing.com:443/");
+
+    return loginInput;
+  }
+
+  private SFLoginInput createGenericLoginInput() {
+    SFLoginInput loginInput = new SFLoginInput();
+    loginInput.setOauthAccessToken(SOME_ACCESS_TOKEN);
+    loginInput.setOauthRefreshToken(SOME_REFRESH_TOKEN);
+    loginInput.setUserName(SOME_USER);
+    return loginInput;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/FileCacheManagerDefaultDirTest.java b/src/test/java/net/snowflake/client/core/FileCacheManagerDefaultDirTest.java
new file mode 100644
index 000000000..1ce5773cf
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/FileCacheManagerDefaultDirTest.java
@@ -0,0 +1,116 @@
+package net.snowflake.client.core;
+
+import java.io.File;
+import net.snowflake.client.annotations.RunOnLinuxOrMac;
+import net.snowflake.client.jdbc.SnowflakeUtil;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+public class FileCacheManagerDefaultDirTest {
+
+  @Test
+  @RunOnLinuxOrMac
+  public void shouldCreateCacheDirForLinuxXDG() {
+    try (MockedStatic<Constants> constantsMockedStatic = Mockito.mockStatic(Constants.class)) {
+      constantsMockedStatic.when(Constants::getOS).thenReturn(Constants.OS.LINUX);
+      try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic =
+          Mockito.mockStatic(SnowflakeUtil.class)) {
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetEnv("XDG_CACHE_HOME"))
+            .thenReturn("/XDG/Cache/");
+        try (MockedStatic<FileUtil> fileUtilMockedStatic = Mockito.mockStatic(FileUtil.class)) {
+          fileUtilMockedStatic.when(() -> FileUtil.isWritable("/XDG/Cache/")).thenReturn(true);
+          File defaultCacheDir = FileCacheManager.getDefaultCacheDir();
+          Assertions.assertNotNull(defaultCacheDir);
+          Assertions.assertEquals("/XDG/Cache/snowflake", defaultCacheDir.getAbsolutePath());
+        }
+      }
+    }
+  }
+
+  @Test
+  @RunOnLinuxOrMac
+  public void shouldCreateCacheDirForLinuxWithoutXDG() {
+    try (MockedStatic<Constants> constantsMockedStatic = Mockito.mockStatic(Constants.class)) {
+      constantsMockedStatic.when(Constants::getOS).thenReturn(Constants.OS.LINUX);
+      try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic =
+          Mockito.mockStatic(SnowflakeUtil.class)) {
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetEnv("XDG_CACHE_HOME"))
+            .thenReturn(null);
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetProperty("user.home"))
+            .thenReturn("/User/Home");
+        try (MockedStatic<FileUtil> fileUtilMockedStatic = Mockito.mockStatic(FileUtil.class)) {
+          fileUtilMockedStatic.when(() -> FileUtil.isWritable("/User/Home")).thenReturn(true);
+          File defaultCacheDir = FileCacheManager.getDefaultCacheDir();
+          Assertions.assertNotNull(defaultCacheDir);
+          Assertions.assertEquals("/User/Home/.cache/snowflake", defaultCacheDir.getAbsolutePath());
+        }
+      }
+    }
+  }
+
+  @Test
+  @RunOnLinuxOrMac
+  public void shouldCreateCacheDirForWindows() {
+    try (MockedStatic<Constants> constantsMockedStatic = Mockito.mockStatic(Constants.class)) {
+      constantsMockedStatic.when(Constants::getOS).thenReturn(Constants.OS.WINDOWS);
+      try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic =
+          Mockito.mockStatic(SnowflakeUtil.class)) {
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetProperty("user.home"))
+            .thenReturn("/User/Home");
+        try (MockedStatic<FileUtil> fileUtilMockedStatic = Mockito.mockStatic(FileUtil.class)) {
+          fileUtilMockedStatic.when(() -> FileUtil.isWritable("/User/Home")).thenReturn(true);
+          File defaultCacheDir = FileCacheManager.getDefaultCacheDir();
+          Assertions.assertNotNull(defaultCacheDir);
+          Assertions.assertEquals(
+              "/User/Home/AppData/Local/Snowflake/Caches", defaultCacheDir.getAbsolutePath());
+        }
+      }
+    }
+  }
+
+  @Test
+  @RunOnLinuxOrMac
+  public void shouldCreateCacheDirForMacOS() {
+    try (MockedStatic<Constants> constantsMockedStatic = Mockito.mockStatic(Constants.class)) {
+      constantsMockedStatic.when(Constants::getOS).thenReturn(Constants.OS.MAC);
+      try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic =
+          Mockito.mockStatic(SnowflakeUtil.class)) {
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetProperty("user.home"))
+            .thenReturn("/User/Home");
+        try (MockedStatic<FileUtil> fileUtilMockedStatic = Mockito.mockStatic(FileUtil.class)) {
+          fileUtilMockedStatic.when(() -> FileUtil.isWritable("/User/Home")).thenReturn(true);
+          File defaultCacheDir = FileCacheManager.getDefaultCacheDir();
+          Assertions.assertNotNull(defaultCacheDir);
+          Assertions.assertEquals(
+              "/User/Home/Library/Caches/Snowflake", defaultCacheDir.getAbsolutePath());
+        }
+      }
+    }
+  }
+
+  @Test
+  @RunOnLinuxOrMac
+  public void shouldReturnNullWhenNoHomeDirSet() {
+    try (MockedStatic<Constants> constantsMockedStatic = Mockito.mockStatic(Constants.class)) {
+      constantsMockedStatic.when(Constants::getOS).thenReturn(Constants.OS.LINUX);
+      try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic =
+          Mockito.mockStatic(SnowflakeUtil.class)) {
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetEnv("XDG_CACHE_HOME"))
+            .thenReturn(null);
+        snowflakeUtilMockedStatic
+            .when(() -> SnowflakeUtil.systemGetProperty("user.home"))
+            .thenReturn(null);
+        File defaultCacheDir = FileCacheManager.getDefaultCacheDir();
+        Assertions.assertNull(defaultCacheDir);
+      }
+    }
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/FileCacheManagerTest.java b/src/test/java/net/snowflake/client/core/FileCacheManagerTest.java
index 023c20d40..17f718864 100644
--- a/src/test/java/net/snowflake/client/core/FileCacheManagerTest.java
+++ b/src/test/java/net/snowflake/client/core/FileCacheManagerTest.java
@@ -38,10 +38,9 @@
 @Tag(TestTags.CORE)
 class FileCacheManagerTest extends BaseJDBCTest {
 
-  private static final String CACHE_FILE_NAME = "temporary_credential.json";
+  private static final String CACHE_FILE_NAME = "credential_cache_v1.json.json";
   private static final String CACHE_DIR_PROP = "net.snowflake.jdbc.temporaryCredentialCacheDir";
   private static final String CACHE_DIR_ENV = "SF_TEMPORARY_CREDENTIAL_CACHE_DIR";
-  private static final long CACHE_EXPIRATION_IN_SECONDS = 86400L;
   private static final long CACHE_FILE_LOCK_EXPIRATION_IN_SECONDS = 60L;
 
   private FileCacheManager fileCacheManager;
@@ -54,7 +53,6 @@ public void setup() throws IOException {
             .setCacheDirectorySystemProperty(CACHE_DIR_PROP)
             .setCacheDirectoryEnvironmentVariable(CACHE_DIR_ENV)
             .setBaseCacheFileName(CACHE_FILE_NAME)
-            .setCacheExpirationInSeconds(CACHE_EXPIRATION_IN_SECONDS)
             .setCacheFileLockExpirationInSeconds(CACHE_FILE_LOCK_EXPIRATION_IN_SECONDS)
             .build();
     cacheFile = createCacheFile();
@@ -65,40 +63,47 @@ public void clean() throws IOException {
     if (Files.exists(cacheFile.toPath())) {
       Files.delete(cacheFile.toPath());
     }
+    if (Files.exists(cacheFile.getParentFile().toPath())) {
+      Files.delete(cacheFile.getParentFile().toPath());
+    }
   }
 
   @ParameterizedTest
   @CsvSource({
-    "rwx------,false",
-    "rw-------,true",
-    "r-x------,false",
-    "r--------,true",
-    "rwxrwx---,false",
-    "rwxrw----,false",
-    "rwxr-x---,false",
-    "rwxr-----,false",
-    "rwx-wx---,false",
-    "rwx-w----,false",
-    "rwx--x---,false",
-    "rwx---rwx,false",
-    "rwx---rw-,false",
-    "rwx---r-x,false",
-    "rwx---r--,false",
-    "rwx----wx,false",
-    "rwx----w-,false",
-    "rwx-----x,false"
+    "rwx------,rwx------,false",
+    "rw-------,rwx------,true",
+    "rw-------,rwx--xrwx,true",
+    "r-x------,rwx------,false",
+    "r--------,rwx------,true",
+    "rwxrwx---,rwx------,false",
+    "rwxrw----,rwx------,false",
+    "rwxr-x---,rwx------,false",
+    "rwxr-----,rwx------,false",
+    "rwx-wx---,rwx------,false",
+    "rwx-w----,rwx------,false",
+    "rwx--x---,rwx------,false",
+    "rwx---rwx,rwx------,false",
+    "rwx---rw-,rwx------,false",
+    "rwx---r-x,rwx------,false",
+    "rwx---r--,rwx------,false",
+    "rwx----wx,rwx------,false",
+    "rwx----w-,rwx------,false",
+    "rwx-----x,rwx------,false"
   })
   @RunOnLinuxOrMac
   public void throwWhenReadCacheFileWithPermissionDifferentThanReadWriteForUserTest(
-      String permission, boolean isSucceed) throws IOException {
+      String permission, String parentDirectoryPermissions, boolean isSucceed) throws IOException {
     fileCacheManager.overrideCacheFile(cacheFile);
     Files.setPosixFilePermissions(cacheFile.toPath(), PosixFilePermissions.fromString(permission));
+    Files.setPosixFilePermissions(
+        cacheFile.getParentFile().toPath(),
+        PosixFilePermissions.fromString(parentDirectoryPermissions));
     if (isSucceed) {
       assertDoesNotThrow(() -> fileCacheManager.readCacheFile());
     } else {
       SecurityException ex =
           assertThrows(SecurityException.class, () -> fileCacheManager.readCacheFile());
-      assertTrue(ex.getMessage().contains("is wider than allowed only to the owner"));
+      assertTrue(ex.getMessage().contains("is wider than allowed."));
     }
   }
 
@@ -134,17 +139,43 @@ public void throwWhenOverrideCacheFileNotFound() {
     assertTrue(
         ex.getMessage()
             .contains(
-                "Unable to access the file to check the permissions. Error: java.nio.file.NoSuchFileException:"));
+                "Unable to access the file/directory to check the permissions. Error: java.nio.file.NoSuchFileException:"));
+  }
+
+  @Test
+  @RunOnLinuxOrMac
+  public void throwWhenSymlinkAsCache() throws IOException {
+    Path symlink = createSymlink();
+    try {
+      SecurityException ex =
+          assertThrows(
+              SecurityException.class, () -> fileCacheManager.overrideCacheFile(symlink.toFile()));
+      assertTrue(ex.getMessage().contains("Symbolic link is not allowed for file cache"));
+    } finally {
+      if (Files.exists(symlink)) {
+        Files.delete(symlink);
+      }
+    }
   }
 
   private File createCacheFile() {
     Path cacheFile =
-        Paths.get(systemGetProperty("user.home"), ".cache", "snowflake2", CACHE_FILE_NAME);
+        Paths.get(systemGetProperty("user.home"), ".cache", "snowflake_cache", CACHE_FILE_NAME);
     try {
       if (Files.exists(cacheFile)) {
         Files.delete(cacheFile);
       }
-      Files.createDirectories(cacheFile.getParent());
+      if (Files.exists(cacheFile.getParent())) {
+        Files.delete(cacheFile.getParent());
+      }
+      Files.createDirectories(
+          cacheFile.getParent(),
+          PosixFilePermissions.asFileAttribute(
+              Stream.of(
+                      PosixFilePermission.OWNER_READ,
+                      PosixFilePermission.OWNER_WRITE,
+                      PosixFilePermission.OWNER_EXECUTE)
+                  .collect(Collectors.toSet())));
       Files.createFile(
           cacheFile,
           PosixFilePermissions.asFileAttribute(
@@ -160,4 +191,12 @@ private File createCacheFile() {
       throw new RuntimeException(e);
     }
   }
+
+  private Path createSymlink() throws IOException {
+    Path link = Paths.get(cacheFile.getParent(), "symlink_" + CACHE_FILE_NAME);
+    if (Files.exists(link)) {
+      Files.delete(link);
+    }
+    return Files.createSymbolicLink(link, cacheFile.toPath());
+  }
 }
diff --git a/src/test/java/net/snowflake/client/core/OAuthAuthorizationCodeFlowLatestIT.java b/src/test/java/net/snowflake/client/core/OAuthAuthorizationCodeFlowLatestIT.java
new file mode 100644
index 000000000..f29919431
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/OAuthAuthorizationCodeFlowLatestIT.java
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import static net.snowflake.client.core.SessionUtilExternalBrowser.AuthExternalBrowserHandlers;
+
+import com.amazonaws.util.StringUtils;
+import java.net.URI;
+import java.time.Duration;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.oauth.AccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthAuthorizationCodeAccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.StateProvider;
+import net.snowflake.client.core.auth.oauth.TokenResponseDTO;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(TestTags.CORE)
+public class OAuthAuthorizationCodeFlowLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/oauth/authorization_code";
+  private static final String SUCCESSFUL_FLOW_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/successful_flow.json";
+  private static final String BROWSER_TIMEOUT_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/browser_timeout_authorization_error.json";
+  private static final String INVALID_SCOPE_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/invalid_scope_error.json";
+  private static final String INVALID_STATE_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/invalid_state_error.json";
+  private static final String TOKEN_REQUEST_ERROR_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/token_request_error.json";
+  private static final String CUSTOM_URLS_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/external_idp_custom_urls.json";
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthAuthorizationCodeFlowLatestIT.class);
+
+  private final AuthExternalBrowserHandlers wiremockProxyRequestBrowserHandler =
+      new WiremockProxyRequestBrowserHandler();
+
+  private final AccessTokenProvider provider =
+      new OAuthAuthorizationCodeAccessTokenProvider(
+          wiremockProxyRequestBrowserHandler, new MockStateProvider(), 30);
+
+  @Test
+  public void successfulFlowScenario() throws SFException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8009/snowflake/oauth-redirect", null, null);
+
+    TokenResponseDTO tokenResponse = provider.getAccessToken(loginInput);
+    String accessToken = tokenResponse.getAccessToken();
+
+    Assertions.assertFalse(StringUtils.isNullOrEmpty(accessToken));
+    Assertions.assertEquals("access-token-123", accessToken);
+  }
+
+  @Test
+  public void customUrlsScenario() throws SFException {
+    importMappingFromResources(CUSTOM_URLS_SCENARIO_MAPPINGS);
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "http://localhost:8007/snowflake/oauth-redirect",
+            String.format("http://%s:%d/authorization", WIREMOCK_HOST, wiremockHttpPort),
+            String.format("http://%s:%d/tokenrequest", WIREMOCK_HOST, wiremockHttpPort));
+
+    TokenResponseDTO tokenResponse = provider.getAccessToken(loginInput);
+    String accessToken = tokenResponse.getAccessToken();
+
+    Assertions.assertFalse(StringUtils.isNullOrEmpty(accessToken));
+    Assertions.assertEquals("access-token-123", accessToken);
+  }
+
+  @Test
+  public void browserTimeoutFlowScenario() {
+    importMappingFromResources(BROWSER_TIMEOUT_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8004/snowflake/oauth-redirect", null, null);
+
+    AccessTokenProvider provider =
+        new OAuthAuthorizationCodeAccessTokenProvider(
+            wiremockProxyRequestBrowserHandler, new MockStateProvider(), 1);
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Authorization request timed out. Snowflake driver did not receive authorization code back to the redirect URI. Verify your security integration and driver configuration."));
+  }
+
+  @Test
+  public void invalidScopeFlowScenario() {
+    importMappingFromResources(INVALID_SCOPE_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8002/snowflake/oauth-redirect", null, null);
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during authorization: invalid_scope, One or more scopes are not configured for the authorization server resource."));
+  }
+
+  @Test
+  public void invalidStateFlowScenario() {
+    importMappingFromResources(INVALID_STATE_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8010/snowflake/oauth-redirect", null, null);
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during OAuth Authorization Code authentication: Invalid authorization request redirection state: invalidstate, expected: abc123"));
+  }
+
+  @Test
+  public void tokenRequestErrorFlowScenario() {
+    importMappingFromResources(TOKEN_REQUEST_ERROR_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8003/snowflake/oauth-redirect", null, null);
+
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains("JDBC driver encountered communication error. Message: HTTP status=400"));
+  }
+
+  private SFLoginInput createLoginInputStub(
+      String redirectUri, String authorizationUrl, String tokenRequestUrl) {
+    SFLoginInput loginInputStub = new SFLoginInput();
+    loginInputStub.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    loginInputStub.setOauthLoginInput(
+        new SFOauthLoginInput(
+            "123", "123", redirectUri, authorizationUrl, tokenRequestUrl, "session:role:ANALYST"));
+    loginInputStub.setSocketTimeout(Duration.ofMinutes(5));
+    loginInputStub.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+
+    return loginInputStub;
+  }
+
+  static class WiremockProxyRequestBrowserHandler implements AuthExternalBrowserHandlers {
+    @Override
+    public HttpPost build(URI uri) {
+      // do nothing
+      return null;
+    }
+
+    @Override
+    public void openBrowser(String ssoUrl) {
+      try (CloseableHttpClient client = HttpClients.createDefault()) {
+        logger.debug("executing browser request to redirect uri: {}", ssoUrl);
+        HttpResponse response = client.execute(new HttpGet(ssoUrl));
+        if (response.getStatusLine().getStatusCode() != 200) {
+          throw new RuntimeException("Invalid response from " + ssoUrl);
+        }
+      } catch (Exception e) {
+        throw new RuntimeException(e);
+      }
+    }
+
+    @Override
+    public void output(String msg) {
+      // do nothing
+    }
+  }
+
+  static class MockStateProvider implements StateProvider<String> {
+
+    @Override
+    public String getState() {
+      return "abc123";
+    }
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/OAuthClientCredentialsFlowLatestIT.java b/src/test/java/net/snowflake/client/core/OAuthClientCredentialsFlowLatestIT.java
new file mode 100644
index 000000000..36d302d2b
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/OAuthClientCredentialsFlowLatestIT.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import com.amazonaws.util.StringUtils;
+import java.time.Duration;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.oauth.AccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthClientCredentialsAccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.TokenResponseDTO;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(TestTags.CORE)
+public class OAuthClientCredentialsFlowLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/oauth/client_credentials";
+  private static final String SUCCESSFUL_FLOW_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/successful_flow.json";
+  private static final String TOKEN_REQUEST_ERROR_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/token_request_error.json";
+
+  @Test
+  public void successfulFlowScenario() throws SFException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8009/snowflake/oauth-redirect");
+
+    AccessTokenProvider provider = new OAuthClientCredentialsAccessTokenProvider();
+    TokenResponseDTO tokenResponse = provider.getAccessToken(loginInput);
+    String accessToken = tokenResponse.getAccessToken();
+
+    Assertions.assertFalse(StringUtils.isNullOrEmpty(accessToken));
+    Assertions.assertEquals("access-token-123", accessToken);
+  }
+
+  @Test
+  public void tokenRequestErrorFlowScenario() {
+    importMappingFromResources(TOKEN_REQUEST_ERROR_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8003/snowflake/oauth-redirect");
+
+    AccessTokenProvider provider = new OAuthClientCredentialsAccessTokenProvider();
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains("JDBC driver encountered communication error. Message: HTTP status=400"));
+  }
+
+  private SFLoginInput createLoginInputStub(String redirectUri) {
+    SFLoginInput loginInputStub = new SFLoginInput();
+    loginInputStub.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    loginInputStub.setOauthLoginInput(
+        new SFOauthLoginInput(
+            "123",
+            "123",
+            redirectUri,
+            null,
+            String.format("http://%s:%d/oauth/token-request", WIREMOCK_HOST, wiremockHttpPort),
+            "session:role:ANALYST"));
+    loginInputStub.setSocketTimeout(Duration.ofMinutes(5));
+    loginInputStub.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+
+    return loginInputStub;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/OAuthTokenCacheLatestIT.java b/src/test/java/net/snowflake/client/core/OAuthTokenCacheLatestIT.java
new file mode 100644
index 000000000..2537e882c
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/OAuthTokenCacheLatestIT.java
@@ -0,0 +1,224 @@
+package net.snowflake.client.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+
+import java.time.Duration;
+import java.util.Collections;
+import java.util.HashMap;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import net.snowflake.client.jdbc.SnowflakeSQLException;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.MockedStatic;
+import org.mockito.stubbing.Answer;
+
+@Tag(TestTags.CORE)
+public class OAuthTokenCacheLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/oauth/token_caching";
+  private static final String CACHING_TOKENS_AFTER_CONNECTING_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/caching_tokens_after_connecting.json";
+  private static final String REUSING_CACHED_ACCESS_TOKEN_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/reusing_cached_access_token_to_authenticate.json";
+  private static final String REFRESHING_EXPIRED_ACCESS_TOKEN_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/refreshing_expired_access_token.json";
+  private static final String
+      CACHING_REFRESHED_ACCESS_TOKEN_AND_NEW_REFRESH_TOKEN_SCENARIO_MAPPINGS =
+          SCENARIOS_BASE_DIR + "/caching_refreshed_access_token_and_new_refresh_token.json";
+  private static final String RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_ERROR_WHEN_REFRESHING =
+      SCENARIOS_BASE_DIR + "/restarting_full_flow_on_refresh_token_error.json";
+  private static final String RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_NO_REFRESH_TOKEN =
+      SCENARIOS_BASE_DIR + "/restarting_full_flow_on_expiration_and_no_refresh_token.json";
+
+  @Test
+  public void shouldCacheAccessTokenAfterConnecting() throws SFException, SnowflakeSQLException {
+    importMappingFromResources(CACHING_TOKENS_AFTER_CONNECTING_SCENARIO_MAPPINGS);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      SFLoginInput loginInput = createLoginInputStub();
+      SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic, "access-token-123", "refresh-token-123");
+    }
+  }
+
+  @Test
+  public void shouldReuseCachedAccessTokenWhenConnecting()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(REUSING_CACHED_ACCESS_TOKEN_SCENARIO_MAPPINGS);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "reused-access-token-123", "reused-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+      assertEquals("reused-access-token-123", loginOutput.getOauthAccessToken());
+      assertEquals("reused-refresh-token-123", loginOutput.getOauthRefreshToken());
+    }
+  }
+
+  @Test
+  public void shouldRefreshExpiredAccessTokenAndConnectSuccessfully()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(REFRESHING_EXPIRED_ACCESS_TOKEN_SCENARIO_MAPPINGS);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "expired-access-token-123", "some-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthRefreshTokenCache(loginInput), never());
+
+      assertEquals("new-refreshed-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic,
+          "new-refreshed-access-token-123",
+          "some-refresh-token-123");
+    }
+  }
+
+  @Test
+  public void shouldCacheRefreshedAccessTokenAndNewRefreshToken()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(
+        CACHING_REFRESHED_ACCESS_TOKEN_AND_NEW_REFRESH_TOKEN_SCENARIO_MAPPINGS);
+
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "expired-access-token-123", "some-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      assertEquals("new-refreshed-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic, "new-refreshed-access-token-123", "new-refresh-token-123");
+    }
+  }
+
+  @Test
+  public void shouldRestartFullFlowOnAccessTokenExpirationAndErrorWhenRefreshing()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_ERROR_WHEN_REFRESHING);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "expired-access-token-123", "some-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthRefreshTokenCache(loginInput), times(1));
+      assertEquals("newly-obtained-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic,
+          "newly-obtained-access-token-123",
+          "newly-obtained-refresh-token");
+    }
+  }
+
+  @Test
+  public void shouldRestartFullFlowOnAccessTokenExpirationAndNoRefreshToken()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_NO_REFRESH_TOKEN);
+
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(credentialManagerMockedStatic, "expired-access-token-123", null);
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthRefreshTokenCache(loginInput), never());
+      assertEquals("newly-obtained-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic, "newly-obtained-access-token-123", null);
+    }
+  }
+
+  private SFLoginInput createLoginInputStub() {
+    SFLoginInput input = new SFLoginInput();
+    input.setAuthenticator(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name());
+    input.setOriginalAuthenticator(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name());
+    input.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    input.setUserName("MOCK_USERNAME");
+    input.setAccountName("MOCK_ACCOUNT_NAME");
+    input.setAppId("MOCK_APP_ID");
+    input.setAppVersion("MOCK_APP_VERSION");
+    input.setOCSPMode(OCSPMode.FAIL_OPEN);
+    input.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+    input.setBrowserResponseTimeout(Duration.ofSeconds(20));
+    input.setLoginTimeout(1000);
+    input.setSessionParameters(Collections.singletonMap("CLIENT_STORE_TEMPORARY_CREDENTIAL", true));
+    input.setOauthLoginInput(
+        new SFOauthLoginInput(
+            "123",
+            "123",
+            null,
+            null,
+            String.format("http://%s:%d/oauth/token-request", WIREMOCK_HOST, wiremockHttpPort),
+            "session:role:ANALYST"));
+    return input;
+  }
+
+  private static void mockLoadingTokensFromCache(
+      MockedStatic<CredentialManager> credentialManagerMock,
+      String oauthAccessToken,
+      String oauthRefreshToken) {
+    Answer<Object> fillCachedOAuthAccessTokenInvocation =
+        invocation -> {
+          ((SFLoginInput) invocation.getArguments()[0]).setOauthAccessToken(oauthAccessToken);
+          return null;
+        };
+    Answer<Object> fillCachedOAuthRefreshTokenInvocation =
+        invocation -> {
+          ((SFLoginInput) invocation.getArguments()[0]).setOauthRefreshToken(oauthRefreshToken);
+          return null;
+        };
+    credentialManagerMock
+        .when(() -> CredentialManager.fillCachedOAuthAccessToken(any(SFLoginInput.class)))
+        .then(fillCachedOAuthAccessTokenInvocation);
+    credentialManagerMock
+        .when(() -> CredentialManager.fillCachedOAuthRefreshToken(any(SFLoginInput.class)))
+        .then(fillCachedOAuthRefreshTokenInvocation);
+  }
+
+  private static void captureAndAssertSavedTokenValues(
+      MockedStatic<CredentialManager> credentialManagerMock,
+      String expectedAccessToken,
+      String expectedRefreshToken) {
+    ArgumentCaptor<SFLoginInput> accessTokenInputCaptor =
+        ArgumentCaptor.forClass(SFLoginInput.class);
+    credentialManagerMock.verify(
+        () -> CredentialManager.writeOAuthAccessToken(accessTokenInputCaptor.capture()));
+    assertEquals(expectedAccessToken, accessTokenInputCaptor.getValue().getOauthAccessToken());
+
+    if (expectedRefreshToken != null) {
+      ArgumentCaptor<SFLoginInput> refreshTokenInputCaptor =
+          ArgumentCaptor.forClass(SFLoginInput.class);
+      credentialManagerMock.verify(
+          () -> CredentialManager.writeOAuthRefreshToken(refreshTokenInputCaptor.capture()));
+      assertEquals(expectedRefreshToken, refreshTokenInputCaptor.getValue().getOauthRefreshToken());
+    } else {
+      credentialManagerMock.verify(
+          () -> CredentialManager.writeOAuthRefreshToken(any(SFLoginInput.class)), never());
+    }
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/ProgrammaticAccessTokenAuthFlowLatestIT.java b/src/test/java/net/snowflake/client/core/ProgrammaticAccessTokenAuthFlowLatestIT.java
new file mode 100644
index 000000000..29ef44e85
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/ProgrammaticAccessTokenAuthFlowLatestIT.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import java.util.HashMap;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import net.snowflake.client.jdbc.SnowflakeSQLException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(TestTags.CORE)
+public class ProgrammaticAccessTokenAuthFlowLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/pat";
+  private static final String SUCCESSFUL_FLOW_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/successful_flow.json";
+  private static final String INVALID_TOKEN_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/invalid_pat_token.json";
+
+  @Test
+  public void successfulFlowScenarioPatAsToken() throws SFException, SnowflakeSQLException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInputWithPatAsToken = createLoginInputStub("MOCK_TOKEN", null);
+    SFLoginOutput loginOutput =
+        SessionUtil.newSession(loginInputWithPatAsToken, new HashMap<>(), "INFO");
+    assertSuccessfulLoginOutput(loginOutput);
+  }
+
+  @Test
+  public void successfulFlowScenarioPatAsPassword() throws SFException, SnowflakeSQLException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInputWithPatAsPassword = createLoginInputStub(null, "MOCK_TOKEN");
+    SFLoginOutput loginOutput =
+        SessionUtil.newSession(loginInputWithPatAsPassword, new HashMap<>(), "INFO");
+    assertSuccessfulLoginOutput(loginOutput);
+  }
+
+  @Test
+  public void invalidTokenScenario() {
+    importMappingFromResources(INVALID_TOKEN_SCENARIO_MAPPINGS);
+    SnowflakeSQLException e =
+        Assertions.assertThrows(
+            SnowflakeSQLException.class,
+            () ->
+                SessionUtil.newSession(
+                    createLoginInputStub("MOCK_TOKEN", null), new HashMap<>(), "INFO"));
+    Assertions.assertEquals("Programmatic access token is invalid.", e.getMessage());
+  }
+
+  private void assertSuccessfulLoginOutput(SFLoginOutput loginOutput) {
+    Assertions.assertNotNull(loginOutput);
+    Assertions.assertEquals("session token", loginOutput.getSessionToken());
+    Assertions.assertEquals("master token", loginOutput.getMasterToken());
+    Assertions.assertEquals(14400, loginOutput.getMasterTokenValidityInSeconds());
+    Assertions.assertEquals("8.48.0", loginOutput.getDatabaseVersion());
+    Assertions.assertEquals("TEST_DHEYMAN", loginOutput.getSessionDatabase());
+    Assertions.assertEquals("TEST_JDBC", loginOutput.getSessionSchema());
+    Assertions.assertEquals("ANALYST", loginOutput.getSessionRole());
+    Assertions.assertEquals("TEST_XSMALL", loginOutput.getSessionWarehouse());
+    Assertions.assertEquals("1172562260498", loginOutput.getSessionId());
+    Assertions.assertEquals(1, loginOutput.getCommonParams().size());
+    Assertions.assertEquals(4, loginOutput.getCommonParams().get("CLIENT_PREFETCH_THREADS"));
+  }
+
+  private SFLoginInput createLoginInputStub(String token, String password) {
+    SFLoginInput input = new SFLoginInput();
+    input.setAuthenticator(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN.name());
+    input.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    input.setUserName("MOCK_USERNAME");
+    input.setAccountName("MOCK_ACCOUNT_NAME");
+    input.setAppId("MOCK_APP_ID");
+    input.setAppVersion("MOCK_APP_VERSION");
+    input.setToken(token);
+    input.setPassword(password);
+    input.setOCSPMode(OCSPMode.FAIL_OPEN);
+    input.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+    input.setLoginTimeout(1000);
+    input.setSessionParameters(new HashMap<>());
+    return input;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/SecureStorageManagerTest.java b/src/test/java/net/snowflake/client/core/SecureStorageManagerTest.java
index b79875038..c135cb6a7 100644
--- a/src/test/java/net/snowflake/client/core/SecureStorageManagerTest.java
+++ b/src/test/java/net/snowflake/client/core/SecureStorageManagerTest.java
@@ -4,6 +4,7 @@
 
 package net.snowflake.client.core;
 
+import static net.snowflake.client.jdbc.SnowflakeUtil.systemGetProperty;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.notNullValue;
@@ -13,6 +14,7 @@
 import com.sun.jna.Memory;
 import com.sun.jna.Pointer;
 import com.sun.jna.ptr.PointerByReference;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
@@ -20,7 +22,11 @@
 import net.snowflake.client.annotations.RunOnMac;
 import net.snowflake.client.annotations.RunOnWindows;
 import net.snowflake.client.annotations.RunOnWindowsOrMac;
+import net.snowflake.client.jdbc.SnowflakeUtil;
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
 
 class MockAdvapi32Lib implements SecureStorageWindowsManager.Advapi32Lib {
   @Override
@@ -224,6 +230,34 @@ public class SecureStorageManagerTest {
   private static final String ID_TOKEN = "ID_TOKEN";
   private static final String MFA_TOKEN = "MFATOKEN";
 
+  @Test
+  public void testBuildCredentialsKey() {
+    // hex values obtained using https://emn178.github.io/online-tools/sha256.html
+    String hashedKey =
+        SecureStorageManager.buildCredentialsKey(
+            host, user, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue());
+    Assertions.assertEquals(
+        "A7C7EBB89312E88552CD00664A0E20929801FACFBD682BF7C2363FB6EC8F914E", hashedKey);
+
+    hashedKey =
+        SecureStorageManager.buildCredentialsKey(
+            host, user, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue());
+    Assertions.assertEquals(
+        "DB37028833FA02B125FBD6DE8CE679C7E62E7D38FAC585E98060E00987F96772", hashedKey);
+
+    hashedKey =
+        SecureStorageManager.buildCredentialsKey(
+            host, user, CachedCredentialType.ID_TOKEN.getValue());
+    Assertions.assertEquals(
+        "6AA3F783E07D1D2182DAB59442806E2433C55C2BD4D9240790FD5B4B91FD4FDB", hashedKey);
+
+    hashedKey =
+        SecureStorageManager.buildCredentialsKey(
+            host, user, CachedCredentialType.MFA_TOKEN.getValue());
+    Assertions.assertEquals(
+        "9D10D4EFE45605D85993C6AC95334F1B63D36611B83615656EC7F277A947BF4B", hashedKey);
+  }
+
   @Test
   @RunOnWindowsOrMac
   public void testLoadNativeLibrary() {
@@ -260,10 +294,22 @@ public void testMacManager() {
   @Test
   @RunOnLinux
   public void testLinuxManager() {
-    SecureStorageManager manager = SecureStorageLinuxManager.getInstance();
-
-    testBody(manager);
-    testDeleteLinux(manager);
+    String cacheDirectory =
+        Paths.get(systemGetProperty("user.home"), ".cache", "snowflake_test_cache")
+            .toAbsolutePath()
+            .toString();
+    try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic =
+        Mockito.mockStatic(SnowflakeUtil.class)) {
+      snowflakeUtilMockedStatic
+          .when(
+              () ->
+                  SnowflakeUtil.systemGetProperty("net.snowflake.jdbc.temporaryCredentialCacheDir"))
+          .thenReturn(cacheDirectory);
+      SecureStorageManager manager = SecureStorageLinuxManager.getInstance();
+
+      testBody(manager);
+      testDeleteLinux(manager);
+    }
   }
 
   private void testBody(SecureStorageManager manager) {
diff --git a/src/test/java/net/snowflake/client/core/SessionUtilTest.java b/src/test/java/net/snowflake/client/core/SessionUtilTest.java
index e7bb3e486..55e54f903 100644
--- a/src/test/java/net/snowflake/client/core/SessionUtilTest.java
+++ b/src/test/java/net/snowflake/client/core/SessionUtilTest.java
@@ -8,7 +8,9 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mockStatic;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.BooleanNode;
 import java.io.IOException;
 import java.net.URI;
@@ -17,12 +19,16 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import net.snowflake.client.core.auth.AuthenticatorType;
 import net.snowflake.client.jdbc.MockConnectionTest;
+import net.snowflake.client.jdbc.SnowflakeUtil;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.client.utils.URIBuilder;
 import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
 
 public class SessionUtilTest {
   private static String originalUrlValue;
@@ -185,6 +191,107 @@ public void shouldDerivePrivateLinkOcspCacheServerUrlBasedOnHost() throws IOExce
         SFTrustManager.SF_OCSP_RESPONSE_CACHE_SERVER_RETRY_URL_PATTERN);
   }
 
+  @Test
+  public void testGetCommonParams() throws Exception {
+    ObjectMapper mapper = ObjectMapperFactory.getObjectMapper();
+
+    // Test unknown param name
+    Map<String, Object> result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": true}]"));
+    assertTrue((boolean) result.get("testParam"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": false}]"));
+    assertFalse((boolean) result.get("testParam"));
+
+    result =
+        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"testParam\", \"value\": 0}]"));
+    assertEquals(0, (int) result.get("testParam"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": 1000}]"));
+    assertEquals(1000, (int) result.get("testParam"));
+
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"\"}]"));
+    assertEquals("", result.get("testParam"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"value\"}]"));
+    assertEquals("value", result.get("testParam"));
+
+    // Test known param name
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": true}]"));
+    assertTrue((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": false}]"));
+    assertFalse((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
+
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree(
+                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 0}]"));
+    assertEquals(0, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree(
+                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 1000}]"));
+    assertEquals(1000, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
+
+    result =
+        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"\"}]"));
+    assertEquals("", result.get("TIMEZONE"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"value\"}]"));
+    assertEquals("value", result.get("TIMEZONE"));
+  }
+
+  @Test
+  public void shouldProperlyCheckIfExperimentalAuthEnabled() {
+    try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic = mockStatic(SnowflakeUtil.class)) {
+      snowflakeUtilMockedStatic
+          .when(() -> SnowflakeUtil.systemGetEnv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION"))
+          .thenReturn(null);
+      Assertions.assertThrows(
+          SFException.class,
+          () ->
+              SessionUtil.checkIfExperimentalAuthnEnabled(
+                  AuthenticatorType.OAUTH_AUTHORIZATION_CODE));
+      Assertions.assertThrows(
+          SFException.class,
+          () ->
+              SessionUtil.checkIfExperimentalAuthnEnabled(
+                  AuthenticatorType.OAUTH_CLIENT_CREDENTIALS));
+      Assertions.assertThrows(
+          SFException.class,
+          () ->
+              SessionUtil.checkIfExperimentalAuthnEnabled(
+                  AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN));
+
+      snowflakeUtilMockedStatic
+          .when(() -> SnowflakeUtil.systemGetEnv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION"))
+          .thenReturn("true");
+      Assertions.assertDoesNotThrow(
+          () ->
+              SessionUtil.checkIfExperimentalAuthnEnabled(
+                  AuthenticatorType.OAUTH_AUTHORIZATION_CODE));
+      Assertions.assertDoesNotThrow(
+          () ->
+              SessionUtil.checkIfExperimentalAuthnEnabled(
+                  AuthenticatorType.OAUTH_CLIENT_CREDENTIALS));
+      Assertions.assertDoesNotThrow(
+          () ->
+              SessionUtil.checkIfExperimentalAuthnEnabled(
+                  AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN));
+    }
+  }
+
   private void resetOcspConfiguration() {
     SFTrustManager.SF_OCSP_RESPONSE_CACHE_SERVER_URL_VALUE = null;
     SFTrustManager.SF_OCSP_RESPONSE_CACHE_SERVER_RETRY_URL_PATTERN = null;
diff --git a/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java b/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java
index 0524ab6b8..c321692b8 100644
--- a/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java
+++ b/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java
@@ -147,7 +147,8 @@ public String answer(InvocationOnMock invocation) throws Throwable {
                             .asBoolean());
                     assertEquals(mockedMfaToken[0], jsonNode.path("data").path("TOKEN").asText());
                     // Normally backend won't send a new mfa token in this case. For testing
-                    // purpose, we issue a new token to test whether the mfa token can be refreshed
+                    // purpose, we issue a new token to test whether the mfa token can be
+                    // refreshed
                     // when receiving a new one from server.
                     res = getNormalMockedHttpResponse(true, 1).toString();
                   } else if (callCount == 3) {
@@ -200,11 +201,13 @@ public String answer(InvocationOnMock invocation) throws Throwable {
       // connect url
       String url = "jdbc:snowflake://testaccount.snowflakecomputing.com";
 
-      // The first connection contains no mfa token. After the connection, a mfa token will be saved
+      // The first connection contains no mfa token. After the connection, a mfa token will be
+      // saved
       Connection con = DriverManager.getConnection(url, prop);
       con.close();
 
-      // The second connection is expected to include the mfa token issued for the first connection
+      // The second connection is expected to include the mfa token issued for the first
+      // connection
       // and a new mfa token is issued
       Connection con1 = DriverManager.getConnection(url, prop);
       con1.close();
@@ -317,7 +320,7 @@ private void testUnavailableLSSWindowsHelper() throws SQLException {
     try {
       SecureStorageWindowsManager.Advapi32LibManager.setInstance(new MockUnavailableAdvapi32Lib());
       SecureStorageWindowsManager manager = SecureStorageWindowsManager.builder();
-      CredentialManager.getInstance().injectSecureStorageManager(manager);
+      CredentialManager.injectSecureStorageManager(manager);
       unavailableLSSWindowsTestBody();
     } finally {
       SecureStorageWindowsManager.Advapi32LibManager.resetInstance();
@@ -329,7 +332,7 @@ public void testUnavailableLocalSecureStorage() throws SQLException {
     try {
       testUnavailableLSSWindowsHelper();
     } finally {
-      CredentialManager.getInstance().resetSecureStorageManager();
+      CredentialManager.resetSecureStorageManager();
     }
   }
 
diff --git a/src/test/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandlerTest.java b/src/test/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandlerTest.java
new file mode 100644
index 000000000..de39df8f0
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandlerTest.java
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.nimbusds.oauth2.sdk.id.State;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import net.snowflake.client.core.SFException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+public class AuthorizationCodeRedirectRequestHandlerTest {
+
+  CompletableFuture<String> authorizationCodeFutureMock = Mockito.mock(CompletableFuture.class);
+
+  @Test
+  public void shouldReturnSuccessResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("code", "some authorization code");
+    params.put("state", "abc");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock).complete("some authorization code");
+    Assertions.assertEquals("Authorization completed successfully.", response);
+  }
+
+  @Test
+  public void shouldReturnRandomErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("error", "some random error");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals("Authorization error: some random error", response);
+  }
+
+  @Test
+  public void shouldReturnEscapedErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("error", "<script>some malicious script<script>");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals(
+        "Authorization error: &lt;script&gt;some malicious script&lt;script&gt;", response);
+  }
+
+  @Test
+  public void shouldReturnInvalidStateErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("authorization_code", "some authorization code");
+    params.put("state", "invalid state");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals(
+        "Authorization error: invalid authorization request redirection state", response);
+  }
+
+  @Test
+  public void shouldReturnAuthorizationCodeAbsentErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("state", "abc");
+    params.put("some-random-param", "some-value");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals(
+        "Authorization error: authorization code has not been returned to the driver.", response);
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactoryTest.java b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactoryTest.java
new file mode 100644
index 000000000..840f0e3d1
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactoryTest.java
@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import java.util.Arrays;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SFOauthLoginInput;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+public class OAuthAccessTokenProviderFactoryTest {
+
+  private final OAuthAccessTokenProviderFactory providerFactory =
+      new OAuthAccessTokenProviderFactory(null, 30);
+
+  @Test
+  public void shouldProperlyReturnIfAuthenticatorIsEligible() {
+    Arrays.stream(AuthenticatorType.values())
+        .forEach(
+            authenticatorType -> {
+              if (authenticatorType == AuthenticatorType.OAUTH_CLIENT_CREDENTIALS
+                  || authenticatorType.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)) {
+                Assertions.assertTrue(
+                    OAuthAccessTokenProviderFactory.isEligible(authenticatorType));
+              } else {
+                Assertions.assertFalse(
+                    OAuthAccessTokenProviderFactory.isEligible(authenticatorType));
+              }
+            });
+  }
+
+  @Test
+  public void shouldProperlyCreateClientCredentialsAccessTokenProvider() throws SFException {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", null, "some/url", null);
+    AccessTokenProvider provider =
+        providerFactory.createAccessTokenProvider(
+            AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput);
+    Assertions.assertNotNull(provider);
+    Assertions.assertInstanceOf(OAuthClientCredentialsAccessTokenProvider.class, provider);
+  }
+
+  @Test
+  public void shouldProperlyCreateAuthzCodeAccessTokenProvider() throws SFException {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", null, null, null);
+    AccessTokenProvider provider =
+        providerFactory.createAccessTokenProvider(
+            AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput);
+    Assertions.assertNotNull(provider);
+    Assertions.assertInstanceOf(OAuthAuthorizationCodeAccessTokenProvider.class, provider);
+  }
+
+  @Test
+  public void shouldProperlyCreateAuthzCodeAccessTokenProviderForExternalIdp() throws SFException {
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "123",
+            "123",
+            "https://some.ext.idp.com/authz",
+            "https://some.ext.idp.com/token",
+            "http://localhost:12345/authz-code");
+    AccessTokenProvider provider =
+        providerFactory.createAccessTokenProvider(
+            AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput);
+    Assertions.assertNotNull(provider);
+    Assertions.assertInstanceOf(OAuthAuthorizationCodeAccessTokenProvider.class, provider);
+  }
+
+  @Test
+  public void shouldFailToCreateClientCredentialsAccessTokenProviderWithoutClientId() {
+    SFLoginInput loginInput = createLoginInputStub(null, "123", null, "some/url", null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing oauthClientId is required for OAUTH_CLIENT_CREDENTIALS authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateClientCredentialsAccessTokenProviderWithoutClientSecret() {
+    SFLoginInput loginInput = createLoginInputStub("123", null, null, "some/url", null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing oauthClientSecret is required for OAUTH_CLIENT_CREDENTIALS authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateClientCredentialsAccessTokenProviderWithoutExtTokenUrl() {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", null, null, null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing oauthTokenRequestUrl is required for OAUTH_CLIENT_CREDENTIALS authentication."));
+  }
+
+  @Test
+  public void shouldProperlyCreateAuthorizationCodeAccessTokenProvider() throws SFException {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", null, null, null);
+    AccessTokenProvider provider =
+        providerFactory.createAccessTokenProvider(
+            AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput);
+    Assertions.assertNotNull(provider);
+    Assertions.assertInstanceOf(OAuthAuthorizationCodeAccessTokenProvider.class, provider);
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithoutClientId() {
+    SFLoginInput loginInput = createLoginInputStub(null, "123", "some/url", "some/url", null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing oauthClientId is required for OAUTH_AUTHORIZATION_CODE authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithoutClientSecret() {
+    SFLoginInput loginInput = createLoginInputStub("123", null, null, null, null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing oauthClientSecret is required for OAUTH_AUTHORIZATION_CODE authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithHttpsRedirectUri() {
+    SFLoginInput loginInput =
+        createLoginInputStub("123", "123", null, null, "https://localhost:1234/");
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage().contains("provided redirect URI should start with \"http\", not \"https\""));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithJustExtAuthzUrl() {
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "123", "123", "https://some.ext.idp.com/authz", null, "http://localhost:1234/");
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during OAuth Authorization Code authentication: For OAUTH_AUTHORIZATION_CODE authentication with external IdP, both oauthAuthorizationUrl and oauthTokenRequestUrl must be specified"));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithJustExtTokenUrl() {
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "123", "123", null, "https://some.ext.idp.com/token", "http://localhost:1234/");
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during OAuth Authorization Code authentication: For OAUTH_AUTHORIZATION_CODE authentication with external IdP, both oauthAuthorizationUrl and oauthTokenRequestUrl must be specified"));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithInvalidAuthzUrl() {
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "123",
+            "123",
+            "invalid/url/format",
+            "https://some.ext.idp.com/token",
+            "http://localhost:1234/");
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during OAuth Authorization Code authentication: OAuth authorization URL and token URL must be specified in proper format; oauthAuthorizationUrl=invalid/url/format oauthTokenRequestUrl=https://some.ext.idp.com/token"));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithInvalidTokenUrl() {
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "123",
+            "123",
+            "https://some.ext.idp.com/authz",
+            "invalid-token-format",
+            "http://localhost:1234/");
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during OAuth Authorization Code authentication: OAuth authorization URL and token URL must be specified in proper format; oauthAuthorizationUrl=https://some.ext.idp.com/authz oauthTokenRequestUrl=invalid-token-format"));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithDifferentUrlDomains()
+      throws SFException {
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "123",
+            "123",
+            "https://malicious.ext.idp.com/authz-url",
+            "https://some.ext.idp.com/token-url",
+            "http://localhost:1234/");
+    SFLogger loggerMock = Mockito.mock(SFLogger.class);
+    try (MockedStatic<SFLoggerFactory> loggerFactoryMockedStatic =
+        Mockito.mockStatic(SFLoggerFactory.class)) {
+      loggerFactoryMockedStatic
+          .when(() -> SFLoggerFactory.getLogger(OAuthAccessTokenProviderFactory.class))
+          .thenReturn(loggerMock);
+      new OAuthAccessTokenProviderFactory(null, 30)
+          .createAccessTokenProvider(AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput);
+      Mockito.verify(loggerMock)
+          .warn(
+              "Both oauthAuthorizationUrl and oauthTokenRequestUrl should belong to the same host; oauthAuthorizationUrl=https://malicious.ext.idp.com/authz-url oauthTokenRequestUrl=https://some.ext.idp.com/token-url");
+    }
+  }
+
+  private SFLoginInput createLoginInputStub(
+      String clientId,
+      String clientSecret,
+      String authorizationUrl,
+      String tokenUrl,
+      String redirectUri) {
+    SFLoginInput loginInput = new SFLoginInput();
+    loginInput.setOauthLoginInput(
+        new SFOauthLoginInput(
+            clientId, clientSecret, redirectUri, authorizationUrl, tokenUrl, null));
+    return loginInput;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/auth/oauth/OAuthUtilTest.java b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthUtilTest.java
new file mode 100644
index 000000000..00f7e4dda
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthUtilTest.java
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2024-2025 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringWriter;
+import java.net.URI;
+import net.snowflake.client.core.SFOauthLoginInput;
+import org.apache.commons.io.IOUtils;
+import org.apache.http.Header;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpRequestBase;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class OAuthUtilTest {
+
+  private static final String BASE_SERVER_URL_FROM_LOGIN_INPUT = "http://some.snowflake.server.com";
+  public static final String ROLE_FROM_LOGIN_INPUT = "ANALYST";
+
+  @Test
+  public void shouldCreateDefaultAuthorizationUrl() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    URI authorizationUrl =
+        OAuthUtil.getAuthorizationUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(authorizationUrl);
+    Assertions.assertEquals(
+        "http://some.snowflake.server.com/oauth/authorize", authorizationUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateUserSuppliedAuthorizationUrl() {
+    SFOauthLoginInput loginInput =
+        createLoginInputStub("http://some.external.authorization.url.com/authz", null, null, null);
+    URI tokenRequestUrl =
+        OAuthUtil.getAuthorizationUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(tokenRequestUrl);
+    Assertions.assertEquals(
+        "http://some.external.authorization.url.com/authz", tokenRequestUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateDefaultTokenRequestUrl() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(tokenRequestUrl);
+    Assertions.assertEquals(
+        "http://some.snowflake.server.com/oauth/token-request", tokenRequestUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateUserSuppliedTokenRequestUrl() {
+    SFOauthLoginInput loginInput =
+        createLoginInputStub(
+            null, "http://some.external.authorization.url.com/token-request", null, null);
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(tokenRequestUrl);
+    Assertions.assertEquals(
+        "http://some.external.authorization.url.com/token-request", tokenRequestUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateDefaultScope() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    String scope = OAuthUtil.getScope(loginInput, ROLE_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(scope);
+    Assertions.assertEquals("session:role:ANALYST", scope);
+  }
+
+  @Test
+  public void shouldCreateUserSuppliedScope() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, "some:custom:SCOPE", null);
+    String scope = OAuthUtil.getScope(loginInput, ROLE_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(scope);
+    Assertions.assertEquals("some:custom:SCOPE", scope);
+  }
+
+  @Test
+  public void shouldCreateDefaultRedirectUri() throws IOException {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    URI redirectUri = OAuthUtil.buildRedirectUri(loginInput);
+    Assertions.assertNotNull(redirectUri);
+    Assertions.assertTrue(
+        redirectUri.toString().matches("^http://127.0.0.1:([0-9]*)/"),
+        "Invalid redirect URI: " + redirectUri);
+  }
+
+  @Test
+  public void shouldCreateCustomRedirectUri() throws IOException {
+    SFOauthLoginInput loginInput =
+        createLoginInputStub(null, null, null, "http://localhost:8989/some-endpoint");
+    URI redirectUri = OAuthUtil.buildRedirectUri(loginInput);
+    Assertions.assertNotNull(redirectUri);
+    Assertions.assertEquals("http://localhost:8989/some-endpoint", redirectUri.toString());
+  }
+
+  @Test
+  public void shouldConvertToBaseAuthorizationRequest() throws IOException {
+    HTTPRequest httpRequest =
+        new HTTPRequest(
+            HTTPRequest.Method.POST, URI.create("https://some.snowflake.server.com/oauth/token"));
+    httpRequest.setAccept("application/json");
+    httpRequest.setAuthorization("Bearer some-token");
+    httpRequest.setBody("{\"grant_type\":\"authorization_code\",\"code\":\"some-code\"}");
+
+    HttpRequestBase httpRequestBase = OAuthUtil.convertToBaseAuthorizationRequest(httpRequest);
+    Assertions.assertNotNull(httpRequestBase);
+    Assertions.assertEquals(HttpPost.class, httpRequestBase.getClass());
+    Assertions.assertEquals(
+        "https://some.snowflake.server.com/oauth/token", httpRequestBase.getURI().toString());
+    Header[] allHeaders = httpRequestBase.getAllHeaders();
+    Assertions.assertNotNull(allHeaders);
+    Assertions.assertEquals(2, allHeaders.length);
+    Assertions.assertEquals("Accept", allHeaders[0].getName());
+    Assertions.assertEquals("application/json", allHeaders[0].getValue());
+    Assertions.assertEquals("Authorization", allHeaders[1].getName());
+    Assertions.assertEquals("Bearer some-token", allHeaders[1].getValue());
+
+    StringWriter writer = new StringWriter();
+    try (InputStream ins = ((HttpPost) httpRequestBase).getEntity().getContent()) {
+      IOUtils.copy(ins, writer, "UTF-8");
+    }
+    Assertions.assertEquals(
+        "{\"grant_type\":\"authorization_code\",\"code\":\"some-code\"}", writer.toString());
+  }
+
+  private SFOauthLoginInput createLoginInputStub(
+      String oauthAuthorizationUrl, String oauthTokenRequestUrl, String scope, String redirectUri) {
+    return new SFOauthLoginInput(
+        null, null, redirectUri, oauthAuthorizationUrl, oauthTokenRequestUrl, scope);
+  }
+}
diff --git a/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java b/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java
index 08069b95c..49d0dcdc0 100644
--- a/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java
+++ b/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java
@@ -10,15 +10,19 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.net.ServerSocket;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Paths;
 import java.time.Duration;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Properties;
 import net.snowflake.client.core.HttpUtil;
 import net.snowflake.client.log.SFLogger;
 import net.snowflake.client.log.SFLoggerFactory;
+import org.apache.commons.io.IOUtils;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
@@ -30,7 +34,7 @@
 import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.BeforeAll;
 
-abstract class BaseWiremockTest {
+public abstract class BaseWiremockTest {
 
   protected static final SFLogger logger = SFLoggerFactory.getLogger(BaseWiremockTest.class);
   protected static final String WIREMOCK_HOME_DIR = ".wiremock";
@@ -38,6 +42,7 @@ abstract class BaseWiremockTest {
       "/.m2/repository/org/wiremock/wiremock-standalone/3.8.0/wiremock-standalone-3.8.0.jar";
   protected static final String WIREMOCK_HOST = "localhost";
   protected static final String TRUST_STORE_PROPERTY = "javax.net.ssl.trustStore";
+  protected static final String MAPPINGS_BASE_DIR = "/wiremock/mappings";
   protected static int wiremockHttpPort;
   protected static int wiremockHttpsPort;
   private static String originalTrustStorePath;
@@ -237,4 +242,13 @@ protected void addMapping(String mapping) {
       throw new RuntimeException(e);
     }
   }
+
+  protected void importMappingFromResources(String relativePath) {
+    try (InputStream is = BaseWiremockTest.class.getResourceAsStream(relativePath)) {
+      String scenario = IOUtils.toString(Objects.requireNonNull(is), StandardCharsets.UTF_8);
+      importMapping(scenario);
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
 }
diff --git a/src/test/java/net/snowflake/client/jdbc/SessionUtilTest.java b/src/test/java/net/snowflake/client/jdbc/SessionUtilTest.java
deleted file mode 100644
index 4056dda1b..000000000
--- a/src/test/java/net/snowflake/client/jdbc/SessionUtilTest.java
+++ /dev/null
@@ -1,74 +0,0 @@
-package net.snowflake.client.jdbc;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import java.util.Map;
-import net.snowflake.client.core.ObjectMapperFactory;
-import net.snowflake.client.core.SessionUtil;
-import org.junit.jupiter.api.Test;
-
-public class SessionUtilTest {
-  @Test
-  public void testGetCommonParams() throws Exception {
-    ObjectMapper mapper = ObjectMapperFactory.getObjectMapper();
-
-    // Test unknown param name
-    Map<String, Object> result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": true}]"));
-    assertTrue((boolean) result.get("testParam"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": false}]"));
-    assertFalse((boolean) result.get("testParam"));
-
-    result =
-        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"testParam\", \"value\": 0}]"));
-    assertEquals(0, (int) result.get("testParam"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": 1000}]"));
-    assertEquals(1000, (int) result.get("testParam"));
-
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"\"}]"));
-    assertEquals("", result.get("testParam"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"value\"}]"));
-    assertEquals("value", result.get("testParam"));
-
-    // Test known param name
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": true}]"));
-    assertTrue((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": false}]"));
-    assertFalse((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
-
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree(
-                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 0}]"));
-    assertEquals(0, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree(
-                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 1000}]"));
-    assertEquals(1000, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
-
-    result =
-        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"\"}]"));
-    assertEquals("", result.get("TIMEZONE"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"value\"}]"));
-    assertEquals("value", result.get("TIMEZONE"));
-  }
-}
diff --git a/src/test/java/net/snowflake/client/util/SecretDetectorTest.java b/src/test/java/net/snowflake/client/util/SecretDetectorTest.java
index 1b936b929..889192f83 100644
--- a/src/test/java/net/snowflake/client/util/SecretDetectorTest.java
+++ b/src/test/java/net/snowflake/client/util/SecretDetectorTest.java
@@ -214,6 +214,8 @@ public void testMaskParameterValue() {
     testParametersMasked.put("password", "test");
     testParametersMasked.put("sessionToken", "test");
     testParametersMasked.put("token", "test");
+    testParametersMasked.put("oauthClientId", "test");
+    testParametersMasked.put("oauthClientSecret", "test");
 
     Map<String, String> testParametersUnmasked = new HashMap<>();
     testParametersUnmasked.put("oktausername", "test");
@@ -249,6 +251,37 @@ public void testMaskconnectionToken() {
         maskedConnectionToken.equals(SecretDetector.maskSecrets(connectionToken)));
   }
 
+  @Test
+  public void testMaskOAuthSecrets() {
+    String tokenResponseJson =
+        "{\n"
+            + "  \"access_token\" : \"some:FAKE_token123\",\n"
+            + "  \"refresh_token\" : \"some:FAKE_token123\",\n"
+            + "  \"token_type\" : \"Bearer\",\n"
+            + "  \"username\" : \"OAUTH_TEST_AUTH_CODE\",\n"
+            + "  \"scope\" : \"refresh_token session:role:ANALYST\",\n"
+            + "  \"expires_in\" : 600,\n"
+            + "  \"refresh_token_expires_in\" : 86399,\n"
+            + "  \"idpInitiated\" : false\n"
+            + "}";
+
+    String maskedTokenResponseJson =
+        "{\n"
+            + "  \"access_token\":\"****\",\n"
+            + "  \"refresh_token\":\"****\",\n"
+            + "  \"token_type\" : \"Bearer\",\n"
+            + "  \"username\" : \"OAUTH_TEST_AUTH_CODE\",\n"
+            + "  \"scope\" : \"refresh_token session:role:ANALYST\",\n"
+            + "  \"expires_in\" : 600,\n"
+            + "  \"refresh_token_expires_in\" : 86399,\n"
+            + "  \"idpInitiated\" : false\n"
+            + "}";
+
+    assertThat(
+        "Text with OAuth tokens is not masked",
+        maskedTokenResponseJson.equals(SecretDetector.maskSecrets(tokenResponseJson)));
+  }
+
   private JSONObject generateJsonObject() {
     // a base json object
     JSONObject obj = new JSONObject();
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/browser_timeout_authorization_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/browser_timeout_authorization_error.json
new file mode 100644
index 000000000..41b5c8045
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/browser_timeout_authorization_error.json
@@ -0,0 +1,16 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Browser Authorization timeout",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 200,
+        "fixedDelayMilliseconds": 5000
+      }
+    }
+  ]
+}
+ 
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/external_idp_custom_urls.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/external_idp_custom_urls.json
new file mode 100644
index 000000000..c03129042
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/external_idp_custom_urls.json
@@ -0,0 +1,76 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Custom urls OAuth authorization code flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authorized",
+      "request": {
+        "urlPathPattern": "/authorization",
+        "method": "GET",
+        "queryParameters": {
+          "response_type": {
+            "equalTo": "code"
+          },
+          "scope": {
+            "equalTo": "session:role:ANALYST"
+          },
+          "code_challenge_method": {
+            "equalTo": "S256"
+          },
+          "redirect_uri": {
+            "equalTo": "http://localhost:8007/snowflake/oauth-redirect"
+          },
+          "code_challenge": {
+            "matches": ".*"
+          },
+          "state": {
+            "matches": ".*"
+          },
+          "client_id": {
+            "equalTo": "123"
+          }
+        }
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8007/snowflake/oauth-redirect?code=123&state=abc123"
+        }
+      }
+    },
+    {
+      "scenarioName": "Custom urls OAuth authorization code flow",
+      "requiredScenarioState": "Authorized",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/tokenrequest.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=authorization_code&code=123&redirect_uri=http%3A%2F%2Flocalhost%3A8007%2Fsnowflake%2Foauth-redirect&code_verifier="
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_scope_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_scope_error.json
new file mode 100644
index 000000000..f92029a2b
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_scope_error.json
@@ -0,0 +1,17 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Invalid scope authorization error",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8002/snowflake/oauth-redirect?error=invalid_scope&error_description=One+or+more+scopes+are+not+configured+for+the+authorization+server+resource."
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_state_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_state_error.json
new file mode 100644
index 000000000..fb19c1cba
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_state_error.json
@@ -0,0 +1,17 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Invalid scope authorization error",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8010/snowflake/oauth-redirect?code=123&state=invalidstate"
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/successful_flow.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/successful_flow.json
new file mode 100644
index 000000000..f49b224b4
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/successful_flow.json
@@ -0,0 +1,77 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful OAuth authorization code flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authorized",
+      "request": {
+        "urlPathPattern": "/oauth/authorize",
+        "queryParameters": {
+          "response_type": {
+            "equalTo": "code"
+          },
+          "scope": {
+            "equalTo": "session:role:ANALYST"
+          },
+          "code_challenge_method": {
+            "equalTo": "S256"
+          },
+          "redirect_uri": {
+            "equalTo": "http://localhost:8009/snowflake/oauth-redirect"
+          },
+          "code_challenge": {
+            "matches": ".*"
+          },
+          "state": {
+            "matches": ".*"
+          },
+          "client_id": {
+            "equalTo": "123"
+          }
+        },
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8009/snowflake/oauth-redirect?code=123&state=abc123"
+        }
+      }
+    },
+    {
+      "scenarioName": "Successful OAuth authorization code flow",
+      "requiredScenarioState": "Authorized",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=authorization_code&code=123&redirect_uri=http%3A%2F%2Flocalhost%3A8009%2Fsnowflake%2Foauth-redirect&code_verifier="
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/token_request_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/token_request_error.json
new file mode 100644
index 000000000..792e1e363
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/token_request_error.json
@@ -0,0 +1,44 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "OAuth token request error",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authorized",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8003/snowflake/oauth-redirect?code=123&state=abc123"
+        }
+      }
+    },
+    {
+      "scenarioName": "OAuth token request error",
+      "requiredScenarioState": "Authorized",
+      "newScenarioState": "Token request error",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=authorization_code&code=123&redirect_uri=http%3A%2F%2Flocalhost%3A8003%2Fsnowflake%2Foauth-redirect&code_verifier="
+          }
+        ]
+      },
+      "response": {
+        "status": 400
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/client_credentials/successful_flow.json b/src/test/resources/wiremock/mappings/oauth/client_credentials/successful_flow.json
new file mode 100644
index 000000000..10ed78c84
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/client_credentials/successful_flow.json
@@ -0,0 +1,39 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful OAuth client credentials flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/client_credentials/token_request_error.json b/src/test/resources/wiremock/mappings/oauth/client_credentials/token_request_error.json
new file mode 100644
index 000000000..72eb97481
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/client_credentials/token_request_error.json
@@ -0,0 +1,29 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "OAuth client credentials flow with token request error",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 400
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/caching_refreshed_access_token_and_new_refresh_token.json b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_refreshed_access_token_and_new_refresh_token.json
new file mode 100644
index 000000000..82ab1ed5d
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_refreshed_access_token_and_new_refresh_token.json
@@ -0,0 +1,174 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Caching refreshed access token and new refresh token",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH",
+                "OAUTH_TYPE": "OAUTH_CLIENT_CREDENTIALS"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Caching refreshed access token and new refresh token",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Acquired new access token and new refresh token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=refresh_token&refresh_token=some-refresh-token-123&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token" : "new-refreshed-access-token-123",
+          "refresh_token": "new-refresh-token-123",
+          "token_type" : "Bearer",
+          "expires_in" : 599,
+          "idpInitiated" : false
+        }
+      }
+    },
+    {
+      "scenarioName": "Caching refreshed access token and new refresh token",
+      "requiredScenarioState": "Acquired new access token and new refresh token",
+      "newScenarioState": "Established session with newly acquired access token and cache both tokens",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "new-refreshed-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/caching_tokens_after_connecting.json b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_tokens_after_connecting.json
new file mode 100644
index 000000000..ac33a8506
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_tokens_after_connecting.json
@@ -0,0 +1,120 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful writing access token and refresh token to empty cache",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Acquired tokens",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "refresh-token-123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }      }
+    },
+    {
+      "scenarioName": "Successful writing access token and refresh token to empty cache",
+      "requiredScenarioState": "Acquired tokens",
+      "newScenarioState": "Cached tokens",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH",
+                "OAUTH_TYPE": "OAUTH_CLIENT_CREDENTIALS"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/refreshing_expired_access_token.json b/src/test/resources/wiremock/mappings/oauth/token_caching/refreshing_expired_access_token.json
new file mode 100644
index 000000000..60842d644
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/refreshing_expired_access_token.json
@@ -0,0 +1,173 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Refreshing expired access token from cache",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH",
+                "OAUTH_TYPE": "OAUTH_CLIENT_CREDENTIALS"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Refreshing expired access token from cache",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Acquired new access token using refresh token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=refresh_token&refresh_token=some-refresh-token-123&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token" : "new-refreshed-access-token-123",
+          "token_type" : "Bearer",
+          "expires_in" : 599,
+          "idpInitiated" : false
+        }
+      }
+    },
+    {
+      "scenarioName": "Refreshing expired access token from cache",
+      "requiredScenarioState": "Acquired new access token using refresh token",
+      "newScenarioState": "Established session with newly acquired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "new-refreshed-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_expiration_and_no_refresh_token.json b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_expiration_and_no_refresh_token.json
new file mode 100644
index 000000000..c9506f096
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_expiration_and_no_refresh_token.json
@@ -0,0 +1,175 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Restarting full flow on access token expiration but no refresh token",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token expiration but no refresh token",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Acquired new access token via Client Credentials flow (no refresh token in cache)",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "newly-obtained-access-token-123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "session:role:ANALYST",
+          "expires_in": 600,
+          "idpInitiated": false
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token expiration but no refresh token",
+      "requiredScenarioState": "Acquired new access token via Client Credentials flow (no refresh token in cache)",
+      "newScenarioState": "Established session with newly acquired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "newly-obtained-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH",
+                "OAUTH_TYPE": "OAUTH_CLIENT_CREDENTIALS"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_refresh_token_error.json b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_refresh_token_error.json
new file mode 100644
index 000000000..d1a4d4b8c
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_refresh_token_error.json
@@ -0,0 +1,205 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH",
+                "OAUTH_TYPE": "OAUTH_CLIENT_CREDENTIALS"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Refreshing token error",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=refresh_token&refresh_token=some-refresh-token-123&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 400,
+        "jsonBody": {
+          "error": "Invalid refresh token"
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Refreshing token error",
+      "newScenarioState": "Acquired new access token via Client Credentials flow",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "newly-obtained-access-token-123",
+          "refresh_token": "newly-obtained-refresh-token",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Acquired new access token via Client Credentials flow",
+      "newScenarioState": "Established session with newly acquired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "newly-obtained-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/reusing_cached_access_token_to_authenticate.json b/src/test/resources/wiremock/mappings/oauth/token_caching/reusing_cached_access_token_to_authenticate.json
new file mode 100644
index 000000000..a754311d0
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/reusing_cached_access_token_to_authenticate.json
@@ -0,0 +1,86 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Reusing access token and refresh token from cache",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Reusing cached tokens",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "reused-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH",
+                "OAUTH_TYPE": "OAUTH_CLIENT_CREDENTIALS"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/pat/invalid_pat_token.json b/src/test/resources/wiremock/mappings/pat/invalid_pat_token.json
new file mode 100644
index 000000000..69ffe0cf9
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/pat/invalid_pat_token.json
@@ -0,0 +1,60 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful PAT authentication flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authenticated",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "MOCK_TOKEN",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "PROGRAMMATIC_ACCESS_TOKEN"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "PAT",
+            "signInOptions": {}
+          },
+          "code": "394400",
+          "message": "Programmatic access token is invalid.",
+          "success": false,
+          "headers": null
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/pat/successful_flow.json b/src/test/resources/wiremock/mappings/pat/successful_flow.json
new file mode 100644
index 000000000..2f25b4088
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/pat/successful_flow.json
@@ -0,0 +1,85 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful PAT authentication flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authenticated",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "MOCK_TOKEN",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "PROGRAMMATIC_ACCESS_TOKEN"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/thin_public_pom.xml b/thin_public_pom.xml
index 06d7d70be..8e1a64ad7 100644
--- a/thin_public_pom.xml
+++ b/thin_public_pom.xml
@@ -55,11 +55,11 @@
     <javax.servlet.version>3.1.0</javax.servlet.version>
     <jna.version>5.13.0</jna.version>
     <joda.time.version>2.8.1</joda.time.version>
-    <json.smart.version>2.4.9</json.smart.version>
+    <json.smart.version>2.5.1</json.smart.version>
     <jsoup.version>1.15.3</jsoup.version>
     <metrics.version>2.2.0</metrics.version>
     <netty.version>4.1.118.Final</netty.version>
-    <nimbusds.version>9.37.3</nimbusds.version>
+    <nimbusds.version>9.40</nimbusds.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <slf4j.version>2.0.13</slf4j.version>
@@ -194,6 +194,11 @@
       <artifactId>nimbus-jose-jwt</artifactId>
       <version>${nimbusds.version}</version>
     </dependency>
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>oauth2-oidc-sdk</artifactId>
+      <version>${nimbusds.oauth2.version}</version>
+    </dependency>
     <dependency>
       <groupId>com.yammer.metrics</groupId>
       <artifactId>metrics-core</artifactId>