diff --git a/FIPS/scripts/check_content.sh b/FIPS/scripts/check_content.sh
index a30eacec6..236114df6 100755
--- a/FIPS/scripts/check_content.sh
+++ b/FIPS/scripts/check_content.sh
@@ -6,7 +6,7 @@ set -o pipefail
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
 
-if jar tvf $DIR/../target/snowflake-jdbc-fips.jar  | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
+if jar tvf $DIR/../target/snowflake-jdbc-fips.jar  | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^iso3166_" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
   echo "[ERROR] JDBC jar includes class not under the snowflake namespace"
   exit 1
 fi
diff --git a/ci/container/test_authentication.sh b/ci/container/test_authentication.sh
index 9a2eddf27..c3f525387 100755
--- a/ci/container/test_authentication.sh
+++ b/ci/container/test_authentication.sh
@@ -16,5 +16,6 @@ $MVNW_EXE -DjenkinsIT \
     -DintegrationTestSuites=AuthenticationTestSuite \
     -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
     -Dnot-self-contained-jar \
+    -Dsnowflake.jdbc.enableSoteria=true \
     verify \
     --batch-mode --show-version
diff --git a/ci/container/test_component.sh b/ci/container/test_component.sh
index 65efed88d..7b9e403c6 100755
--- a/ci/container/test_component.sh
+++ b/ci/container/test_component.sh
@@ -85,6 +85,7 @@ if [[ "$is_old_driver" == "true" ]]; then
             -Djacoco.skip.instrument=false \
             -DintegrationTestSuites="$JDBC_TEST_SUITES" \
             -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
+            -Dsnowflake.jdbc.enableSoteria=true \
             verify \
             --batch-mode --show-version
     popd >& /dev/null
@@ -97,6 +98,7 @@ elif [[ "$JDBC_TEST_SUITES" == "FipsTestSuite" ]]; then
             -DintegrationTestSuites=FipsTestSuite \
             -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
             -Dnot-self-contained-jar \
+            -Dsnowflake.jdbc.enableSoteria=true \
             verify \
             --batch-mode --show-version
     popd >& /dev/null
@@ -108,6 +110,7 @@ else
         -DintegrationTestSuites="$JDBC_TEST_SUITES" \
         -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
         -Dnot-self-contained-jar $ADDITIONAL_MAVEN_PROFILE \
+        -Dsnowflake.jdbc.enableSoteria=true \
         verify \
         --batch-mode --show-version
 fi
diff --git a/ci/scripts/check_content.sh b/ci/scripts/check_content.sh
index 1af33e56a..e74264cb8 100755
--- a/ci/scripts/check_content.sh
+++ b/ci/scripts/check_content.sh
@@ -8,7 +8,7 @@ set -o pipefail
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
 
-if jar tvf $DIR/../../target/snowflake-jdbc${package_modifier}.jar | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
+if jar $DIR/../../target/snowflake-jdbc${package_modifier}.jar | awk '{print $8}' | grep -v -E "/$" | grep -v -E "^(net|com)/snowflake" | grep -v -E "(com|net)/\$" | grep -v -E "^META-INF" | grep -v -E "^iso3166_" | grep -v -E "^mozilla" | grep -v -E "^com/sun/jna" | grep -v com/sun/ | grep -v mime.types | grep -v -E "^com/github/luben/zstd/" | grep -v -E "^aix/" | grep -v -E "^darwin/" | grep -v -E "^freebsd/" | grep -v -E "^linux/" | grep -v -E "^win/"; then
   echo "[ERROR] JDBC jar includes class not under the snowflake namespace"
   exit 1
 fi
diff --git a/ci/test_windows.bat b/ci/test_windows.bat
index 0234b105c..a9f9818b7 100644
--- a/ci/test_windows.bat
+++ b/ci/test_windows.bat
@@ -120,6 +120,7 @@ if "%JDBC_TEST_SUITES%"=="FipsTestSuite" (
         -DintegrationTestSuites=FipsTestSuite ^
         -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn ^
         -Dnot-self-contained-jar ^
+        -Dsnowflake.jdbc.enableSoteria=true ^
         verify ^
         --batch-mode --show-version > log.txt & type log.txt
     echo "[INFO] Check for test execution status"
@@ -140,6 +141,7 @@ if "%JDBC_TEST_SUITES%"=="FipsTestSuite" (
         -DintegrationTestSuites="%JDBC_TEST_SUITES%" ^
         -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn ^
         -Dnot-self-contained-jar %ADDITIONAL_MAVEN_PROFILE% ^
+        -Dsnowflake.jdbc.enableSoteria=true ^
         verify ^
         --batch-mode --show-version > log.txt & type log.txt
     echo "[INFO] Check for test execution status"
diff --git a/linkage-checker-exclusion-rules.xml b/linkage-checker-exclusion-rules.xml
index 64b5860c2..cc7640d8f 100644
--- a/linkage-checker-exclusion-rules.xml
+++ b/linkage-checker-exclusion-rules.xml
@@ -29,6 +29,7 @@
         <Source><Package name="com.google.api.gax"/></Source>
         <Reason>?</Reason>
     </LinkageError>
+
     <LinkageError>
         <Target><Package name="org.osgi"/></Target>
         <Source><Package name="org.apache.tika.config"/></Source>
@@ -49,6 +50,26 @@
         <Source><Package name="org.bouncycastle.pqc.legacy.crypto.ntru"/></Source>
         <Reason>?</Reason>
     </LinkageError>
+    <LinkageError>
+        <Target><Package name="org.cryptomator"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
+    <LinkageError>
+        <Target><Package name="org.opensaml"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
+    <LinkageError>
+        <Target><Package name="jakarta.servlet"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
+    <LinkageError>
+        <Target><Package name="net.shibboleth.utilities"/></Target>
+        <Source><Package name="com.nimbusds"/></Source>
+        <Reason>?</Reason>
+    </LinkageError>
     <!--
     <LinkageError>
         <Target><Package name=""/></Target>
diff --git a/parent-pom.xml b/parent-pom.xml
index 0dcfc90f0..32bce7be7 100644
--- a/parent-pom.xml
+++ b/parent-pom.xml
@@ -21,7 +21,7 @@
     <apache.httpcore.version>4.4.16</apache.httpcore.version>
     <zstd-jni.version>1.5.6-5</zstd-jni.version>
     <arrow.version>17.0.0</arrow.version>
-    <asm.version>9.3</asm.version>
+    <asm.version>9.6</asm.version>
     <avro.version>1.8.1</avro.version>
     <awaitility.version>4.2.0</awaitility.version>
     <awssdk.version>1.12.655</awssdk.version>
@@ -60,7 +60,7 @@
     <javax.servlet.version>3.1.0</javax.servlet.version>
     <jna.version>5.13.0</jna.version>
     <joda.time.version>2.8.1</joda.time.version>
-    <json.smart.version>2.4.9</json.smart.version>
+    <json.smart.version>2.5.1</json.smart.version>
     <junit4.version>4.13.2</junit4.version>
     <junit.version>5.11.1</junit.version>
     <junit.platform.version>1.11.1</junit.platform.version>
@@ -69,7 +69,8 @@
     <metrics.version>2.2.0</metrics.version>
     <mockito.version>4.11.0</mockito.version>
     <netty.version>4.1.115.Final</netty.version>
-    <nimbusds.version>9.37.3</nimbusds.version>
+    <nimbusds.version>9.40</nimbusds.version>
+    <nimbusds.oauth2.version>11.20.1</nimbusds.oauth2.version>
     <opencensus.version>0.31.1</opencensus.version>
     <plexus.container.version>1.0-alpha-9-stable-1</plexus.container.version>
     <plexus.utils.version>3.4.2</plexus.utils.version>
@@ -219,6 +220,11 @@
         <artifactId>nimbus-jose-jwt</artifactId>
         <version>${nimbusds.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.nimbusds</groupId>
+        <artifactId>oauth2-oidc-sdk</artifactId>
+        <version>${nimbusds.oauth2.version}</version>
+      </dependency>
       <dependency>
         <groupId>com.yammer.metrics</groupId>
         <artifactId>metrics-core</artifactId>
@@ -657,6 +663,10 @@
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
     </dependency>
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>oauth2-oidc-sdk</artifactId>
+    </dependency>
     <dependency>
       <groupId>com.yammer.metrics</groupId>
       <artifactId>metrics-core</artifactId>
diff --git a/src/main/java/net/snowflake/client/core/AssertUtil.java b/src/main/java/net/snowflake/client/core/AssertUtil.java
index c24139fa9..149634238 100644
--- a/src/main/java/net/snowflake/client/core/AssertUtil.java
+++ b/src/main/java/net/snowflake/client/core/AssertUtil.java
@@ -16,7 +16,8 @@ public class AssertUtil {
    * @param internalErrorMesg The error message to display if condition is false
    * @throws SFException Will be thrown if condition is false
    */
-  static void assertTrue(boolean condition, String internalErrorMesg) throws SFException {
+  @SnowflakeJdbcInternalApi
+  public static void assertTrue(boolean condition, String internalErrorMesg) throws SFException {
     if (!condition) {
       throw new SFException(ErrorCode.INTERNAL_ERROR, internalErrorMesg);
     }
diff --git a/src/main/java/net/snowflake/client/core/CachedCredentialType.java b/src/main/java/net/snowflake/client/core/CachedCredentialType.java
new file mode 100644
index 000000000..c3b4d9269
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/CachedCredentialType.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+enum CachedCredentialType {
+  ID_TOKEN("ID_TOKEN"),
+  MFA_TOKEN("MFATOKEN"),
+  OAUTH_ACCESS_TOKEN("OAUTH_ACCESS_TOKEN"),
+  OAUTH_REFRESH_TOKEN("OAUTH_REFRESH_TOKEN");
+
+  private final String value;
+
+  CachedCredentialType(String value) {
+    this.value = value;
+  }
+
+  String getValue() {
+    return value;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/Constants.java b/src/main/java/net/snowflake/client/core/Constants.java
index 608661d22..2d9591b96 100644
--- a/src/main/java/net/snowflake/client/core/Constants.java
+++ b/src/main/java/net/snowflake/client/core/Constants.java
@@ -22,6 +22,10 @@ public final class Constants {
   // Error code for all invalid id token cases during login request
   public static final int ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE = 390195;
 
+  public static final int OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE = 390318;
+
+  public static final int OAUTH_ACCESS_TOKEN_INVALID_GS_CODE = 390303;
+
   // Error message for IOException when no space is left for GET
   public static final String NO_SPACE_LEFT_ON_DEVICE_ERR = "No space left on device";
 
diff --git a/src/main/java/net/snowflake/client/core/CredentialManager.java b/src/main/java/net/snowflake/client/core/CredentialManager.java
index 691430edd..37e3e7d48 100644
--- a/src/main/java/net/snowflake/client/core/CredentialManager.java
+++ b/src/main/java/net/snowflake/client/core/CredentialManager.java
@@ -5,6 +5,7 @@
 package net.snowflake.client.core;
 
 import com.google.common.base.Strings;
+import java.net.URI;
 import net.snowflake.client.log.SFLogger;
 import net.snowflake.client.log.SFLoggerFactory;
 
@@ -13,9 +14,6 @@ public class CredentialManager {
 
   private SecureStorageManager secureStorageManager;
 
-  private static final String ID_TOKEN = "ID_TOKEN";
-  private static final String MFA_TOKEN = "MFATOKEN";
-
   private CredentialManager() {
     initSecureStorageManager();
   }
@@ -37,9 +35,9 @@ private void initSecureStorageManager() {
   }
 
   /** Helper function for tests to go back to normal settings. */
-  void resetSecureStorageManager() {
+  static void resetSecureStorageManager() {
     logger.debug("Resetting the secure storage manager");
-    initSecureStorageManager();
+    getInstance().initSecureStorageManager();
   }
 
   /**
@@ -47,9 +45,9 @@ void resetSecureStorageManager() {
    *
    * @param manager SecureStorageManager
    */
-  void injectSecureStorageManager(SecureStorageManager manager) {
+  static void injectSecureStorageManager(SecureStorageManager manager) {
     logger.debug("Injecting secure storage manager");
-    secureStorageManager = manager;
+    getInstance().secureStorageManager = manager;
   }
 
   private static class CredentialManagerHolder {
@@ -65,12 +63,17 @@ public static CredentialManager getInstance() {
    *
    * @param loginInput login input to attach id token
    */
-  void fillCachedIdToken(SFLoginInput loginInput) throws SFException {
+  static void fillCachedIdToken(SFLoginInput loginInput) throws SFException {
     logger.debug(
         "Looking for cached id token for user: {}, host: {}",
         loginInput.getUserName(),
         loginInput.getHostFromServerUrl());
-    fillCachedCredential(loginInput, ID_TOKEN);
+    getInstance()
+        .fillCachedCredential(
+            loginInput,
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            CachedCredentialType.ID_TOKEN);
   }
 
   /**
@@ -78,32 +81,62 @@ void fillCachedIdToken(SFLoginInput loginInput) throws SFException {
    *
    * @param loginInput login input to attach mfa token
    */
-  void fillCachedMfaToken(SFLoginInput loginInput) throws SFException {
+  static void fillCachedMfaToken(SFLoginInput loginInput) throws SFException {
     logger.debug(
         "Looking for cached mfa token for user: {}, host: {}",
         loginInput.getUserName(),
         loginInput.getHostFromServerUrl());
-    fillCachedCredential(loginInput, MFA_TOKEN);
+    getInstance()
+        .fillCachedCredential(
+            loginInput,
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            CachedCredentialType.MFA_TOKEN);
+  }
+
+  /**
+   * Reuse the cached OAuth access token stored locally
+   *
+   * @param loginInput login input to attach access token
+   */
+  static void fillCachedOAuthAccessToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Looking for cached OAuth access token for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .fillCachedCredential(
+            loginInput, host, loginInput.getUserName(), CachedCredentialType.OAUTH_ACCESS_TOKEN);
   }
 
   /**
-   * Reuse the cached token stored locally
+   * Reuse the cached OAuth refresh token stored locally
    *
-   * @param loginInput login input to attach token
-   * @param credType credential type to retrieve
+   * @param loginInput login input to attach refresh token
    */
-  synchronized void fillCachedCredential(SFLoginInput loginInput, String credType)
-      throws SFException {
+  static void fillCachedOAuthRefreshToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Looking for cached OAuth refresh token for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .fillCachedCredential(
+            loginInput, host, loginInput.getUserName(), CachedCredentialType.OAUTH_REFRESH_TOKEN);
+  }
+
+  /** Reuse the cached token stored locally */
+  synchronized void fillCachedCredential(
+      SFLoginInput loginInput, String host, String username, CachedCredentialType credType) {
     if (secureStorageManager == null) {
       logMissingJnaJarForSecureLocalStorage();
       return;
     }
 
-    String cred = null;
+    String cred;
     try {
-      cred =
-          secureStorageManager.getCredential(
-              loginInput.getHostFromServerUrl(), loginInput.getUserName(), credType);
+      cred = secureStorageManager.getCredential(host, username, credType.getValue());
     } catch (NoClassDefFoundError error) {
       logMissingJnaJarForSecureLocalStorage();
       return;
@@ -113,64 +146,98 @@ synchronized void fillCachedCredential(SFLoginInput loginInput, String credType)
       logger.debug("Retrieved {} is null", credType);
     }
 
-    // cred can be null
-    if (credType == ID_TOKEN) {
-      logger.debug(
-          "Setting {}id token for user: {}, host: {}",
-          cred == null ? "null " : "",
-          loginInput.getUserName(),
-          loginInput.getHostFromServerUrl());
-      loginInput.setIdToken(cred);
-    } else if (credType == MFA_TOKEN) {
-      logger.debug(
-          "Setting {}mfa token for user: {}, host: {}",
-          cred == null ? "null " : "",
-          loginInput.getUserName(),
-          loginInput.getHostFromServerUrl());
-      loginInput.setMfaToken(cred);
-    } else {
-      logger.debug("Unrecognized type {} for local cached credential", credType);
+    logger.debug(
+        "Setting {}{} token for user: {}, host: {}",
+        cred == null ? "null " : "",
+        credType.getValue(),
+        username,
+        host);
+    switch (credType) {
+      case ID_TOKEN:
+        loginInput.setIdToken(cred);
+        break;
+      case MFA_TOKEN:
+        loginInput.setMfaToken(cred);
+        break;
+      case OAUTH_ACCESS_TOKEN:
+        loginInput.setOauthAccessToken(cred);
+        break;
+      case OAUTH_REFRESH_TOKEN:
+        loginInput.setOauthRefreshToken(cred);
+        break;
+      default:
+        logger.debug("Unrecognized type {} for local cached credential", credType);
+        break;
     }
-    return;
   }
 
-  /**
-   * Store ID Token
-   *
-   * @param loginInput loginInput to denote to the cache
-   * @param loginOutput loginOutput to denote to the cache
-   */
-  void writeIdToken(SFLoginInput loginInput, SFLoginOutput loginOutput) throws SFException {
+  static void writeIdToken(SFLoginInput loginInput, String idToken) throws SFException {
     logger.debug(
         "Caching id token in a secure storage for user: {}, host: {}",
         loginInput.getUserName(),
         loginInput.getHostFromServerUrl());
-    writeTemporaryCredential(loginInput, loginOutput.getIdToken(), ID_TOKEN);
+    getInstance()
+        .writeTemporaryCredential(
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            idToken,
+            CachedCredentialType.ID_TOKEN);
+  }
+
+  static void writeMfaToken(SFLoginInput loginInput, String mfaToken) throws SFException {
+    logger.debug(
+        "Caching mfa token in a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        loginInput.getHostFromServerUrl());
+    getInstance()
+        .writeTemporaryCredential(
+            loginInput.getHostFromServerUrl(),
+            loginInput.getUserName(),
+            mfaToken,
+            CachedCredentialType.MFA_TOKEN);
   }
 
   /**
-   * Store MFA Token
+   * Store OAuth Access Token
    *
    * @param loginInput loginInput to denote to the cache
-   * @param loginOutput loginOutput to denote to the cache
    */
-  void writeMfaToken(SFLoginInput loginInput, SFLoginOutput loginOutput) throws SFException {
+  static void writeOAuthAccessToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
     logger.debug(
-        "Caching mfa token in a secure storage for user: {}, host: {}",
+        "Caching OAuth access token in a secure storage for user: {}, host: {}",
         loginInput.getUserName(),
-        loginInput.getHostFromServerUrl());
-    writeTemporaryCredential(loginInput, loginOutput.getMfaToken(), MFA_TOKEN);
+        host);
+    getInstance()
+        .writeTemporaryCredential(
+            host,
+            loginInput.getUserName(),
+            loginInput.getOauthAccessToken(),
+            CachedCredentialType.OAUTH_ACCESS_TOKEN);
   }
 
   /**
-   * Store the temporary credential
+   * Store OAuth Refresh Token
    *
    * @param loginInput loginInput to denote to the cache
-   * @param cred the credential
-   * @param credType type of the credential
    */
-  synchronized void writeTemporaryCredential(SFLoginInput loginInput, String cred, String credType)
-      throws SFException {
+  static void writeOAuthRefreshToken(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Caching OAuth refresh token in a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .writeTemporaryCredential(
+            host,
+            loginInput.getUserName(),
+            loginInput.getOauthRefreshToken(),
+            CachedCredentialType.OAUTH_REFRESH_TOKEN);
+  }
+
+  /** Store the temporary credential */
+  synchronized void writeTemporaryCredential(
+      String host, String user, String cred, CachedCredentialType credType) {
     if (Strings.isNullOrEmpty(cred)) {
       logger.debug("No {} is given.", credType);
       return; // no credential
@@ -182,25 +249,62 @@ synchronized void writeTemporaryCredential(SFLoginInput loginInput, String cred,
     }
 
     try {
-      secureStorageManager.setCredential(
-          loginInput.getHostFromServerUrl(), loginInput.getUserName(), credType, cred);
+      secureStorageManager.setCredential(host, user, credType.getValue(), cred);
     } catch (NoClassDefFoundError error) {
       logMissingJnaJarForSecureLocalStorage();
     }
   }
 
   /** Delete the id token cache */
-  void deleteIdTokenCache(String host, String user) {
+  static void deleteIdTokenCache(String host, String user) {
     logger.debug(
         "Removing cached id token from a secure storage for user: {}, host: {}", user, host);
-    deleteTemporaryCredential(host, user, ID_TOKEN);
+    getInstance().deleteTemporaryCredential(host, user, CachedCredentialType.ID_TOKEN);
   }
 
   /** Delete the mfa token cache */
-  void deleteMfaTokenCache(String host, String user) {
+  static void deleteMfaTokenCache(String host, String user) {
     logger.debug(
         "Removing cached mfa token from a secure storage for user: {}, host: {}", user, host);
-    deleteTemporaryCredential(host, user, MFA_TOKEN);
+    getInstance().deleteTemporaryCredential(host, user, CachedCredentialType.MFA_TOKEN);
+  }
+
+  /** Delete the OAuth access token cache */
+  static void deleteOAuthAccessTokenCache(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Removing cached OAuth access token from a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .deleteTemporaryCredential(
+            host, loginInput.getUserName(), CachedCredentialType.OAUTH_ACCESS_TOKEN);
+  }
+
+  /** Delete the OAuth refresh token cache */
+  static void deleteOAuthRefreshTokenCache(SFLoginInput loginInput) throws SFException {
+    String host = getHostForOAuthCacheKey(loginInput);
+    logger.debug(
+        "Removing cached OAuth refresh token from a secure storage for user: {}, host: {}",
+        loginInput.getUserName(),
+        host);
+    getInstance()
+        .deleteTemporaryCredential(
+            host, loginInput.getUserName(), CachedCredentialType.OAUTH_REFRESH_TOKEN);
+  }
+
+  /**
+   * Method required for OAuth token caching, since actual token is not Snowflake account-specific,
+   * but rather IdP-specific
+   */
+  static String getHostForOAuthCacheKey(SFLoginInput loginInput) throws SFException {
+    String externalTokenRequestUrl = loginInput.getOauthLoginInput().getExternalTokenRequestUrl();
+    if (externalTokenRequestUrl != null) {
+      URI parsedUrl = URI.create(externalTokenRequestUrl);
+      return parsedUrl.getHost();
+    } else {
+      return loginInput.getHostFromServerUrl();
+    }
   }
 
   /**
@@ -210,14 +314,15 @@ void deleteMfaTokenCache(String host, String user) {
    * @param user user name
    * @param credType type of the credential
    */
-  synchronized void deleteTemporaryCredential(String host, String user, String credType) {
+  synchronized void deleteTemporaryCredential(
+      String host, String user, CachedCredentialType credType) {
     if (secureStorageManager == null) {
       logMissingJnaJarForSecureLocalStorage();
       return;
     }
 
     try {
-      secureStorageManager.deleteCredential(host, user, credType);
+      secureStorageManager.deleteCredential(host, user, credType.getValue());
     } catch (NoClassDefFoundError error) {
       logMissingJnaJarForSecureLocalStorage();
     }
diff --git a/src/main/java/net/snowflake/client/core/SFLoginInput.java b/src/main/java/net/snowflake/client/core/SFLoginInput.java
index 5f52b64af..b638c0991 100644
--- a/src/main/java/net/snowflake/client/core/SFLoginInput.java
+++ b/src/main/java/net/snowflake/client/core/SFLoginInput.java
@@ -19,6 +19,7 @@ public class SFLoginInput {
   private String warehouse;
   private String role;
   private boolean validateDefaultParameters;
+  private String originalAuthenticator;
   private String authenticator;
   private String oktaUserName;
   private String accountName;
@@ -41,6 +42,8 @@ public class SFLoginInput {
   private String application;
   private String idToken;
   private String mfaToken;
+  private String oauthAccessToken;
+  private String oauthRefreshToken;
   private String serviceName;
   private OCSPMode ocspMode;
   private HttpClientSettingsKey httpClientKey;
@@ -49,6 +52,8 @@ public class SFLoginInput {
   private String privateKeyPwd;
   private String inFlightCtx; // Opaque string sent for Snowsight account activation
 
+  private SFOauthLoginInput oauthLoginInput;
+
   private boolean disableConsoleLogin = true;
   private boolean disableSamlURLCheck = false;
   private boolean enableClientStoreTemporaryCredential;
@@ -59,7 +64,8 @@ public class SFLoginInput {
   // Additional headers to add for Snowsight.
   Map<String, String> additionalHttpHeadersForSnowsight;
 
-  SFLoginInput() {}
+  @SnowflakeJdbcInternalApi
+  public SFLoginInput() {}
 
   Duration getBrowserResponseTimeout() {
     return browserResponseTimeout;
@@ -74,7 +80,8 @@ public String getServerUrl() {
     return serverUrl;
   }
 
-  SFLoginInput setServerUrl(String serverUrl) {
+  @SnowflakeJdbcInternalApi
+  public SFLoginInput setServerUrl(String serverUrl) {
     this.serverUrl = serverUrl;
     return this;
   }
@@ -160,7 +167,8 @@ public SFLoginInput setAccountName(String accountName) {
     return this;
   }
 
-  int getLoginTimeout() {
+  @SnowflakeJdbcInternalApi
+  public int getLoginTimeout() {
     return loginTimeout;
   }
 
@@ -184,7 +192,8 @@ SFLoginInput setRetryTimeout(int retryTimeout) {
     return this;
   }
 
-  int getAuthTimeout() {
+  @SnowflakeJdbcInternalApi
+  public int getAuthTimeout() {
     return authTimeout;
   }
 
@@ -238,7 +247,8 @@ SFLoginInput setConnectionTimeout(Duration connectionTimeout) {
     return this;
   }
 
-  int getSocketTimeoutInMillis() {
+  @SnowflakeJdbcInternalApi
+  public int getSocketTimeoutInMillis() {
     return (int) socketTimeout.toMillis();
   }
 
@@ -310,6 +320,25 @@ SFLoginInput setMfaToken(String mfaToken) {
     return this;
   }
 
+  String getOauthAccessToken() {
+    return oauthAccessToken;
+  }
+
+  SFLoginInput setOauthAccessToken(String oauthAccessToken) {
+    this.oauthAccessToken = oauthAccessToken;
+    return this;
+  }
+
+  @SnowflakeJdbcInternalApi
+  public String getOauthRefreshToken() {
+    return oauthRefreshToken;
+  }
+
+  SFLoginInput setOauthRefreshToken(String oauthRefreshToken) {
+    this.oauthRefreshToken = oauthRefreshToken;
+    return this;
+  }
+
   Map<String, Object> getSessionParameters() {
     return sessionParameters;
   }
@@ -388,7 +417,8 @@ SFLoginInput setOCSPMode(OCSPMode ocspMode) {
     return this;
   }
 
-  HttpClientSettingsKey getHttpClientSettingsKey() {
+  @SnowflakeJdbcInternalApi
+  public HttpClientSettingsKey getHttpClientSettingsKey() {
     return httpClientKey;
   }
 
@@ -396,13 +426,13 @@ SFLoginInput setHttpClientSettingsKey(HttpClientSettingsKey key) {
     this.httpClientKey = key;
     return this;
   }
-
   // Opaque string sent for Snowsight account activation
+
   String getInFlightCtx() {
     return inFlightCtx;
   }
-
   // Opaque string sent for Snowsight account activation
+
   SFLoginInput setInFlightCtx(String inFlightCtx) {
     this.inFlightCtx = inFlightCtx;
     return this;
@@ -420,7 +450,6 @@ SFLoginInput setDisableSamlURLCheck(boolean disableSamlURLCheck) {
   Map<String, String> getAdditionalHttpHeadersForSnowsight() {
     return additionalHttpHeadersForSnowsight;
   }
-
   /**
    * Set additional http headers to apply to the outgoing request. The additional headers cannot be
    * used to replace or overwrite a header in use by the driver. These will be applied to the
@@ -485,4 +514,24 @@ SFLoginInput setEnableClientRequestMfaToken(boolean enableClientRequestMfaToken)
     this.enableClientRequestMfaToken = enableClientRequestMfaToken;
     return this;
   }
+
+  @SnowflakeJdbcInternalApi
+  public SFOauthLoginInput getOauthLoginInput() {
+    return oauthLoginInput;
+  }
+
+  @SnowflakeJdbcInternalApi
+  public SFLoginInput setOauthLoginInput(SFOauthLoginInput oauthLoginInput) {
+    this.oauthLoginInput = oauthLoginInput;
+    return this;
+  }
+
+  void restoreOriginalAuthenticator() {
+    this.authenticator = this.originalAuthenticator;
+  }
+
+  SFLoginInput setOriginalAuthenticator(String originalAuthenticator) {
+    this.originalAuthenticator = originalAuthenticator;
+    return this;
+  }
 }
diff --git a/src/main/java/net/snowflake/client/core/SFLoginOutput.java b/src/main/java/net/snowflake/client/core/SFLoginOutput.java
index 3470076b9..f52b9c0af 100644
--- a/src/main/java/net/snowflake/client/core/SFLoginOutput.java
+++ b/src/main/java/net/snowflake/client/core/SFLoginOutput.java
@@ -14,6 +14,8 @@ public class SFLoginOutput {
   private long masterTokenValidityInSeconds;
   private String idToken;
   private String mfaToken;
+  private String oauthAccessToken;
+  private String oauthRefreshToken;
   private String databaseVersion;
   private int databaseMajorVersion;
   private int databaseMinorVersion;
@@ -35,6 +37,8 @@ public class SFLoginOutput {
       long masterTokenValidityInSeconds,
       String idToken,
       String mfaToken,
+      String oauthAccessToken,
+      String oauthRefreshToken,
       String databaseVersion,
       int databaseMajorVersion,
       int databaseMinorVersion,
@@ -50,6 +54,8 @@ public class SFLoginOutput {
     this.masterToken = masterToken;
     this.idToken = idToken;
     this.mfaToken = mfaToken;
+    this.oauthAccessToken = oauthAccessToken;
+    this.oauthRefreshToken = oauthRefreshToken;
     this.databaseVersion = databaseVersion;
     this.databaseMajorVersion = databaseMajorVersion;
     this.databaseMinorVersion = databaseMinorVersion;
@@ -98,6 +104,14 @@ String getMfaToken() {
     return mfaToken;
   }
 
+  String getOauthAccessToken() {
+    return oauthAccessToken;
+  }
+
+  String getOauthRefreshToken() {
+    return oauthRefreshToken;
+  }
+
   String getDatabaseVersion() {
     return databaseVersion;
   }
diff --git a/src/main/java/net/snowflake/client/core/SFOauthLoginInput.java b/src/main/java/net/snowflake/client/core/SFOauthLoginInput.java
new file mode 100644
index 000000000..5bbb11d45
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/SFOauthLoginInput.java
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+@SnowflakeJdbcInternalApi
+public class SFOauthLoginInput {
+
+  private final String clientId;
+  private final String clientSecret;
+  private final String redirectUri;
+  private final String externalAuthorizationUrl;
+  private final String externalTokenRequestUrl;
+  private final String scope;
+
+  public SFOauthLoginInput(
+      String clientId,
+      String clientSecret,
+      String redirectUri,
+      String externalAuthorizationUrl,
+      String externalTokenRequestUrl,
+      String scope) {
+    this.redirectUri = redirectUri;
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+    this.externalAuthorizationUrl = externalAuthorizationUrl;
+    this.externalTokenRequestUrl = externalTokenRequestUrl;
+    this.scope = scope;
+  }
+
+  public String getRedirectUri() {
+    return redirectUri;
+  }
+
+  public String getClientId() {
+    return clientId;
+  }
+
+  public String getClientSecret() {
+    return clientSecret;
+  }
+
+  public String getExternalAuthorizationUrl() {
+    return externalAuthorizationUrl;
+  }
+
+  public String getExternalTokenRequestUrl() {
+    return externalTokenRequestUrl;
+  }
+
+  public String getScope() {
+    return scope;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/SFSession.java b/src/main/java/net/snowflake/client/core/SFSession.java
index 16e11e445..959d82f5d 100644
--- a/src/main/java/net/snowflake/client/core/SFSession.java
+++ b/src/main/java/net/snowflake/client/core/SFSession.java
@@ -86,6 +86,8 @@ public class SFSession extends SFBaseSession {
   private long masterTokenValidityInSeconds;
   private String idToken;
   private String mfaToken;
+  private String oauthAccessToken;
+  private String oauthRefreshToken;
   private String privateKeyFileLocation;
   private String privateKeyBase64;
   private String privateKeyPassword;
@@ -259,7 +261,7 @@ private JsonNode getQueryMetadata(String queryID) throws SQLException {
             // If we fail to renew the session based on a re-authentication error, try to
             // re-authenticate the session first
             if (ex instanceof SnowflakeReauthenticationRequest
-                && this.isExternalbrowserAuthenticator()) {
+                && this.isExternalbrowserOrOAuthFullFlowAuthenticator()) {
               try {
                 this.open();
               } catch (SFException e) {
@@ -661,6 +663,14 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
 
     // TODO: temporarily hardcode sessionParameter debug info. will be changed in the future
     SFLoginInput loginInput = new SFLoginInput();
+    SFOauthLoginInput oauthLoginInput =
+        new SFOauthLoginInput(
+            (String) connectionPropertiesMap.get(SFSessionProperty.CLIENT_ID),
+            (String) connectionPropertiesMap.get(SFSessionProperty.CLIENT_SECRET),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_REDIRECT_URI),
+            (String) connectionPropertiesMap.get(SFSessionProperty.EXTERNAL_AUTHORIZATION_URL),
+            (String) connectionPropertiesMap.get(SFSessionProperty.EXTERNAL_TOKEN_REQUEST_URL),
+            (String) connectionPropertiesMap.get(SFSessionProperty.OAUTH_SCOPE));
 
     loginInput
         .setServerUrl((String) connectionPropertiesMap.get(SFSessionProperty.SERVER_URL))
@@ -671,6 +681,8 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
         .setValidateDefaultParameters(
             connectionPropertiesMap.get(SFSessionProperty.VALIDATE_DEFAULT_PARAMETERS))
         .setAuthenticator((String) connectionPropertiesMap.get(SFSessionProperty.AUTHENTICATOR))
+        .setOriginalAuthenticator(
+            (String) connectionPropertiesMap.get(SFSessionProperty.AUTHENTICATOR))
         .setOKTAUserName((String) connectionPropertiesMap.get(SFSessionProperty.OKTA_USERNAME))
         .setAccountName((String) connectionPropertiesMap.get(SFSessionProperty.ACCOUNT))
         .setLoginTimeout(loginTimeout)
@@ -698,6 +710,7 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
         .setSessionParameters(sessionParametersMap)
         .setPrivateKey((PrivateKey) connectionPropertiesMap.get(SFSessionProperty.PRIVATE_KEY))
         .setPrivateKeyFile((String) connectionPropertiesMap.get(SFSessionProperty.PRIVATE_KEY_FILE))
+        .setOauthLoginInput(oauthLoginInput)
         .setPrivateKeyBase64(
             (String) connectionPropertiesMap.get(SFSessionProperty.PRIVATE_KEY_BASE64))
         .setPrivateKeyPwd(
@@ -747,6 +760,8 @@ public synchronized void open() throws SFException, SnowflakeSQLException {
     masterToken = loginOutput.getMasterToken();
     idToken = loginOutput.getIdToken();
     mfaToken = loginOutput.getMfaToken();
+    oauthAccessToken = loginOutput.getOauthAccessToken();
+    oauthRefreshToken = loginOutput.getOauthRefreshToken();
     setDatabaseVersion(loginOutput.getDatabaseVersion());
     setDatabaseMajorVersion(loginOutput.getDatabaseMajorVersion());
     setDatabaseMinorVersion(loginOutput.getDatabaseMinorVersion());
@@ -834,15 +849,12 @@ private boolean isSnowflakeAuthenticator() {
         || AuthenticatorType.SNOWFLAKE.name().equalsIgnoreCase(authenticator);
   }
 
-  /**
-   * Returns true If authenticator is EXTERNALBROWSER.
-   *
-   * @return true if authenticator type is EXTERNALBROWSER
-   */
-  boolean isExternalbrowserAuthenticator() {
+  boolean isExternalbrowserOrOAuthFullFlowAuthenticator() {
     Map<SFSessionProperty, Object> connectionPropertiesMap = getConnectionPropertiesMap();
     String authenticator = (String) connectionPropertiesMap.get(SFSessionProperty.AUTHENTICATOR);
-    return AuthenticatorType.EXTERNALBROWSER.name().equalsIgnoreCase(authenticator);
+    return AuthenticatorType.EXTERNALBROWSER.name().equalsIgnoreCase(authenticator)
+        || AuthenticatorType.OAUTH_AUTHORIZATION_CODE.name().equalsIgnoreCase(authenticator)
+        || AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name().equalsIgnoreCase(authenticator);
   }
 
   /**
@@ -892,6 +904,8 @@ synchronized void renewSession(String prevSessionToken)
         .setMasterToken(masterToken)
         .setIdToken(idToken)
         .setMfaToken(mfaToken)
+        .setOauthAccessToken(oauthAccessToken)
+        .setOauthRefreshToken(oauthRefreshToken)
         .setLoginTimeout(loginTimeout)
         .setRetryTimeout(retryTimeout)
         .setDatabaseName(getDatabase())
diff --git a/src/main/java/net/snowflake/client/core/SFSessionProperty.java b/src/main/java/net/snowflake/client/core/SFSessionProperty.java
index f282b3019..012744772 100644
--- a/src/main/java/net/snowflake/client/core/SFSessionProperty.java
+++ b/src/main/java/net/snowflake/client/core/SFSessionProperty.java
@@ -29,6 +29,12 @@ public enum SFSessionProperty {
   AUTHENTICATOR("authenticator", false, String.class),
   OKTA_USERNAME("oktausername", false, String.class),
   PRIVATE_KEY("privateKey", false, PrivateKey.class),
+  OAUTH_REDIRECT_URI("redirectUri", false, String.class),
+  CLIENT_ID("clientID", false, String.class),
+  CLIENT_SECRET("clientSecret", false, String.class),
+  OAUTH_SCOPE("scope", false, String.class),
+  EXTERNAL_AUTHORIZATION_URL("externalAuthorizationUrl", false, String.class),
+  EXTERNAL_TOKEN_REQUEST_URL("externalTokenRequestUrl", false, String.class),
   WAREHOUSE("warehouse", false, String.class),
   LOGIN_TIMEOUT("loginTimeout", false, Integer.class),
   NETWORK_TIMEOUT("networkTimeout", false, Integer.class),
diff --git a/src/main/java/net/snowflake/client/core/SFStatement.java b/src/main/java/net/snowflake/client/core/SFStatement.java
index 0d0668e27..bcb88da5f 100644
--- a/src/main/java/net/snowflake/client/core/SFStatement.java
+++ b/src/main/java/net/snowflake/client/core/SFStatement.java
@@ -505,8 +505,8 @@ public Object executeHelper(
               // renew the session
               session.renewSession(stmtInput.sessionToken);
             } catch (SnowflakeReauthenticationRequest ex0) {
-              if (session.isExternalbrowserAuthenticator()) {
-                reauthenticate();
+              if (session.isExternalbrowserOrOAuthFullFlowAuthenticator()) {
+                session.open();
               } else {
                 throw ex0;
               }
@@ -695,19 +695,6 @@ public SFBaseResultSet execute(
     return execute(sql, false, parametersBinding, caller, execTimeData);
   }
 
-  private void reauthenticate() throws SFException, SnowflakeSQLException {
-    SFLoginInput input =
-        new SFLoginInput()
-            .setRole(session.getRole())
-            .setWarehouse(session.getWarehouse())
-            .setDatabaseName(session.getDatabase())
-            .setSchemaName(session.getSchema())
-            .setOCSPMode(session.getOCSPMode())
-            .setHttpClientSettingsKey(session.getHttpClientKey());
-
-    session.open();
-  }
-
   /**
    * A helper method to build URL and cancel the SQL for exec
    *
diff --git a/src/main/java/net/snowflake/client/core/SessionUtil.java b/src/main/java/net/snowflake/client/core/SessionUtil.java
index e13c21162..f0a7df219 100644
--- a/src/main/java/net/snowflake/client/core/SessionUtil.java
+++ b/src/main/java/net/snowflake/client/core/SessionUtil.java
@@ -28,6 +28,10 @@
 import net.snowflake.client.core.auth.AuthenticatorType;
 import net.snowflake.client.core.auth.ClientAuthnDTO;
 import net.snowflake.client.core.auth.ClientAuthnParameter;
+import net.snowflake.client.core.auth.oauth.AccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthAccessTokenForRefreshTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthAccessTokenProviderFactory;
+import net.snowflake.client.core.auth.oauth.TokenResponseDTO;
 import net.snowflake.client.jdbc.ErrorCode;
 import net.snowflake.client.jdbc.SnowflakeDriver;
 import net.snowflake.client.jdbc.SnowflakeReauthenticationRequest;
@@ -138,6 +142,7 @@ public class SessionUtil {
   public static int DEFAULT_CLIENT_PREFETCH_THREADS = 4;
   public static int MIN_CLIENT_CHUNK_SIZE = 48;
   public static int MAX_CLIENT_CHUNK_SIZE = 160;
+
   public static Map<String, String> JVM_PARAMS_TO_PARAMS =
       Stream.of(
               new String[][] {
@@ -217,9 +222,21 @@ private static AuthenticatorType getAuthenticator(SFLoginInput loginInput) {
           .equalsIgnoreCase(AuthenticatorType.EXTERNALBROWSER.name())) {
         // SAML 2.0 compliant service/application
         return AuthenticatorType.EXTERNALBROWSER;
+      } else if (loginInput
+          .getAuthenticator()
+          .equalsIgnoreCase(AuthenticatorType.OAUTH_AUTHORIZATION_CODE.name())) {
+        return AuthenticatorType.OAUTH_AUTHORIZATION_CODE;
+      } else if (loginInput
+          .getAuthenticator()
+          .equalsIgnoreCase(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name())) {
+        return AuthenticatorType.OAUTH_CLIENT_CREDENTIALS;
       } else if (loginInput.getAuthenticator().equalsIgnoreCase(AuthenticatorType.OAUTH.name())) {
-        // OAuth Authentication
+        // OAuth access code Authentication
         return AuthenticatorType.OAUTH;
+      } else if (loginInput
+          .getAuthenticator()
+          .equalsIgnoreCase(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN.name())) {
+        return AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN;
       } else if (loginInput
           .getAuthenticator()
           .equalsIgnoreCase(AuthenticatorType.SNOWFLAKE_JWT.name())) {
@@ -266,17 +283,22 @@ static SFLoginOutput openSession(
         loginInput.getLoginTimeout() >= 0, "negative login timeout for opening session");
 
     final AuthenticatorType authenticator = getAuthenticator(loginInput);
-    if (!authenticator.equals(AuthenticatorType.OAUTH)) {
-      // OAuth does not require a username
-      AssertUtil.assertTrue(
-          loginInput.getUserName() != null, "missing user name for opening session");
-    } else {
-      // OAUTH needs either token or passord
+    checkIfSoteriaAuthnEnabled(authenticator);
+
+    if (authenticator.equals(AuthenticatorType.OAUTH)
+        || authenticator.equals(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN)) {
+      // OAUTH and PAT needs either token or password
       AssertUtil.assertTrue(
           loginInput.getToken() != null || loginInput.getPassword() != null,
           "missing token or password for opening session");
+    } else {
+      // OAuth and PAT do not require a username
+      AssertUtil.assertTrue(
+          loginInput.getUserName() != null, "missing user name for opening session");
     }
-    if (authenticator.equals(AuthenticatorType.EXTERNALBROWSER)) {
+    if (authenticator.equals(AuthenticatorType.EXTERNALBROWSER)
+        || authenticator.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)
+        || authenticator.equals(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS)) {
       if ((Constants.getOS() == Constants.OS.MAC || Constants.getOS() == Constants.OS.WINDOWS)
           && loginInput.isEnableClientStoreTemporaryCredential()) {
         // force to set the flag for Mac/Windows users
@@ -305,24 +327,96 @@ static SFLoginOutput openSession(
       }
     }
 
-    preNewSession(loginInput);
+    readCachedTokens(loginInput);
+
+    if (OAuthAccessTokenProviderFactory.isEligible(getAuthenticator(loginInput))) {
+      obtainAuthAccessTokenAndUpdateInput(loginInput);
+    }
 
     try {
       return newSession(loginInput, connectionPropertiesMap, tracingLevel);
     } catch (SnowflakeReauthenticationRequest ex) {
-      // Id Token expired. We run newSession again with id_token cache cleared
-      logger.debug("ID Token being used has expired. Reauthenticating with ID Token cleared...");
+      if (ex.getErrorCode() == Constants.OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) {
+        if (loginInput.getOauthRefreshToken() != null) {
+          refreshOAuthAccessTokenAndUpdateInput(loginInput);
+        } else {
+          loginInput.restoreOriginalAuthenticator();
+          fetchOAuthAccessTokenAndUpdateInput(loginInput);
+        }
+      }
       return newSession(loginInput, connectionPropertiesMap, tracingLevel);
     }
   }
 
-  private static void preNewSession(SFLoginInput loginInput) throws SFException {
+  static void checkIfSoteriaAuthnEnabled(AuthenticatorType authenticator) throws SFException {
+    if (authenticator.equals(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN)
+        || authenticator.equals(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS)
+        || authenticator.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)) {
+      boolean soteriaAuthenticationMethodsEnabled =
+          Boolean.parseBoolean(systemGetProperty("snowflake.jdbc.enableSoteria"));
+      AssertUtil.assertTrue(
+          soteriaAuthenticationMethodsEnabled,
+          "Following authentication method not yet supported: " + authenticator);
+    }
+  }
+
+  private static void obtainAuthAccessTokenAndUpdateInput(SFLoginInput loginInput)
+      throws SFException {
+    if (loginInput.getOauthAccessToken() != null) { // Access Token was cached
+      loginInput.setAuthenticator(AuthenticatorType.OAUTH.name());
+      loginInput.setToken(loginInput.getOauthAccessToken());
+    } else { // Access Token not cached
+      fetchOAuthAccessTokenAndUpdateInput(loginInput);
+    }
+  }
+
+  private static void fetchOAuthAccessTokenAndUpdateInput(SFLoginInput loginInput)
+      throws SFException {
+    OAuthAccessTokenProviderFactory accessTokenProviderFactory =
+        new OAuthAccessTokenProviderFactory(
+            new SessionUtilExternalBrowser.DefaultAuthExternalBrowserHandlers(),
+            loginInput.getBrowserResponseTimeout().getSeconds());
+    AccessTokenProvider accessTokenProvider =
+        accessTokenProviderFactory.createAccessTokenProvider(
+            getAuthenticator(loginInput), loginInput);
+    TokenResponseDTO tokenResponse = accessTokenProvider.getAccessToken(loginInput);
+    loginInput.setAuthenticator(AuthenticatorType.OAUTH.name());
+    loginInput.setToken(tokenResponse.getAccessToken());
+    loginInput.setOauthAccessToken(tokenResponse.getAccessToken());
+    loginInput.setOauthRefreshToken(tokenResponse.getRefreshToken());
+  }
+
+  private static void refreshOAuthAccessTokenAndUpdateInput(SFLoginInput loginInput)
+      throws SFException {
+    try {
+      OAuthAccessTokenForRefreshTokenProvider tokenRefresher =
+          new OAuthAccessTokenForRefreshTokenProvider();
+      TokenResponseDTO tokenResponse = tokenRefresher.getAccessToken(loginInput);
+      loginInput.setToken(tokenResponse.getAccessToken());
+      loginInput.setOauthAccessToken(tokenResponse.getAccessToken());
+      loginInput.setAuthenticator(AuthenticatorType.OAUTH.name());
+      if (tokenResponse.getRefreshToken() != null) {
+        loginInput.setOauthRefreshToken(tokenResponse.getRefreshToken());
+      }
+    } catch (SFException | Exception e) {
+      logger.debug(
+          "Refreshing OAuth access token failed. Removing OAuth refresh token from cache and restarting OAuth flow...",
+          e);
+      CredentialManager.deleteOAuthRefreshTokenCache(loginInput);
+      loginInput.restoreOriginalAuthenticator();
+      fetchOAuthAccessTokenAndUpdateInput(loginInput);
+    }
+  }
+
+  private static void readCachedTokens(SFLoginInput loginInput) throws SFException {
     if (asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
-      CredentialManager.getInstance().fillCachedIdToken(loginInput);
+      CredentialManager.fillCachedIdToken(loginInput);
+      CredentialManager.fillCachedOAuthAccessToken(loginInput);
+      CredentialManager.fillCachedOAuthRefreshToken(loginInput);
     }
 
     if (asBoolean(loginInput.getSessionParameters().get(CLIENT_REQUEST_MFA_TOKEN))) {
-      CredentialManager.getInstance().fillCachedMfaToken(loginInput);
+      CredentialManager.fillCachedMfaToken(loginInput);
     }
   }
 
@@ -339,7 +433,7 @@ private static boolean asBoolean(Object value) {
     return false;
   }
 
-  private static SFLoginOutput newSession(
+  static SFLoginOutput newSession(
       SFLoginInput loginInput,
       Map<SFSessionProperty, Object> connectionPropertiesMap,
       String tracingLevel)
@@ -482,7 +576,8 @@ private static SFLoginOutput newSession(
         }
       } else if (authenticatorType == AuthenticatorType.OKTA) {
         data.put(ClientAuthnParameter.RAW_SAML_RESPONSE.name(), tokenOrSamlResponse);
-      } else if (authenticatorType == AuthenticatorType.OAUTH) {
+      } else if (authenticatorType == AuthenticatorType.OAUTH
+          || authenticatorType == AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN) {
         data.put(ClientAuthnParameter.AUTHENTICATOR.name(), authenticatorType.name());
 
         // Fix for HikariCP refresh token issue:SNOW-533673.
@@ -775,11 +870,25 @@ private static SFLoginOutput newSession(
           deleteIdTokenCache(loginInput.getHostFromServerUrl(), loginInput.getUserName());
 
           logger.debug(
-              "ID Token Expired / Not Applicable. Reauthenticating without ID Token...: {}",
+              "ID Token Expired / Not Applicable. Reauthenticating with ID Token cleared...: {}",
               errorCode);
           SnowflakeUtil.checkErrorAndThrowExceptionIncludingReauth(jsonNode);
         }
 
+        if (errorCode == Constants.OAUTH_ACCESS_TOKEN_INVALID_GS_CODE) {
+          logger.debug("OAuth Access Token Invalid: {}", errorCode);
+          loginInput.setOauthAccessToken(null);
+          CredentialManager.deleteOAuthAccessTokenCache(loginInput);
+        }
+
+        if (errorCode == Constants.OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) {
+          loginInput.setOauthAccessToken(null);
+          CredentialManager.deleteOAuthAccessTokenCache(loginInput);
+
+          logger.debug("OAuth Access Token Expired: {}", errorCode);
+          SnowflakeUtil.checkErrorAndThrowExceptionIncludingReauth(jsonNode);
+        }
+
         if (authenticatorType == AuthenticatorType.USERNAME_PASSWORD_MFA) {
           deleteMfaTokenCache(loginInput.getHostFromServerUrl(), loginInput.getUserName());
         }
@@ -903,6 +1012,8 @@ private static SFLoginOutput newSession(
             masterTokenValidityInSeconds,
             idToken,
             mfaToken,
+            loginInput.getOauthAccessToken(),
+            loginInput.getOauthRefreshToken(),
             databaseVersion,
             databaseMajorVersion,
             databaseMinorVersion,
@@ -915,13 +1026,20 @@ private static SFLoginOutput newSession(
             sessionId,
             commonParams);
 
-    if (consentCacheIdToken
-        && asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
-      CredentialManager.getInstance().writeIdToken(loginInput, ret);
+    if (asBoolean(loginInput.getSessionParameters().get(CLIENT_STORE_TEMPORARY_CREDENTIAL))) {
+      if (consentCacheIdToken) {
+        CredentialManager.writeIdToken(loginInput, ret.getIdToken());
+      }
+      if (loginInput.getOauthAccessToken() != null) {
+        CredentialManager.writeOAuthAccessToken(loginInput);
+      }
+      if (loginInput.getOauthRefreshToken() != null) {
+        CredentialManager.writeOAuthRefreshToken(loginInput);
+      }
     }
 
     if (asBoolean(loginInput.getSessionParameters().get(CLIENT_REQUEST_MFA_TOKEN))) {
-      CredentialManager.getInstance().writeMfaToken(loginInput, ret);
+      CredentialManager.writeMfaToken(loginInput, ret.getMfaToken());
     }
 
     stopwatch.stop();
@@ -955,7 +1073,7 @@ private static String nullStringAsEmptyString(String value) {
    * @param user The user
    */
   public static void deleteIdTokenCache(String host, String user) {
-    CredentialManager.getInstance().deleteIdTokenCache(host, user);
+    CredentialManager.deleteIdTokenCache(host, user);
   }
 
   /**
@@ -965,19 +1083,12 @@ public static void deleteIdTokenCache(String host, String user) {
    * @param user The user
    */
   public static void deleteMfaTokenCache(String host, String user) {
-    CredentialManager.getInstance().deleteMfaTokenCache(host, user);
+    CredentialManager.deleteMfaTokenCache(host, user);
   }
 
   /**
    * Renew a session.
    *
-   * <p>Use cases: - Session and Master tokens are provided. No Id token: - succeed in getting a new
-   * Session token. - fail and raise SnowflakeReauthenticationRequest because Master token expires.
-   * Since no id token exists, the exception is thrown to the upstream. - Session and Id tokens are
-   * provided. No Master token: - fail and raise SnowflakeReauthenticationRequest and issue a new
-   * Session token - fail and raise SnowflakeReauthenticationRequest and fail to issue a new Session
-   * token as the
-   *
    * @param loginInput login information
    * @return login output
    * @throws SFException if unexpected uri information
@@ -985,10 +1096,10 @@ public static void deleteMfaTokenCache(String host, String user) {
    */
   static SFLoginOutput renewSession(SFLoginInput loginInput)
       throws SFException, SnowflakeSQLException {
-    return tokenRequest(loginInput, TokenRequestType.RENEW);
+    return renewTokenRequest(loginInput);
   }
 
-  private static SFLoginOutput tokenRequest(SFLoginInput loginInput, TokenRequestType requestType)
+  private static SFLoginOutput renewTokenRequest(SFLoginInput loginInput)
       throws SFException, SnowflakeSQLException {
     AssertUtil.assertTrue(loginInput.getServerUrl() != null, "missing server URL for tokenRequest");
 
@@ -1032,7 +1143,7 @@ private static SFLoginOutput tokenRequest(SFLoginInput loginInput, TokenRequestT
       Map<String, String> payload = new HashMap<>();
       String headerToken = loginInput.getMasterToken();
       payload.put("oldSessionToken", loginInput.getSessionToken());
-      payload.put("requestType", requestType.value);
+      payload.put("requestType", TokenRequestType.RENEW.value);
       String json = mapper.writeValueAsString(payload);
 
       // attach the login info json body to the post request
@@ -1055,7 +1166,7 @@ private static SFLoginOutput tokenRequest(SFLoginInput loginInput, TokenRequestT
 
       logger.debug(
           "Request type: {}, old session token: {}, " + "master token: {}",
-          requestType.value,
+          TokenRequestType.RENEW.value,
           (ArgSupplier) () -> loginInput.getSessionToken() != null ? "******" : null,
           (ArgSupplier) () -> loginInput.getMasterToken() != null ? "******" : null);
 
diff --git a/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java b/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java
index 0f83a9642..fd5c93c01 100644
--- a/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java
+++ b/src/main/java/net/snowflake/client/core/SessionUtilExternalBrowser.java
@@ -61,7 +61,8 @@ public interface AuthExternalBrowserHandlers {
     void output(String msg);
   }
 
-  static class DefaultAuthExternalBrowserHandlers implements AuthExternalBrowserHandlers {
+  @SnowflakeJdbcInternalApi
+  public static class DefaultAuthExternalBrowserHandlers implements AuthExternalBrowserHandlers {
     @Override
     public HttpPost build(URI uri) {
       return new HttpPost(uri);
diff --git a/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java b/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java
index e25af718a..9917c23e6 100644
--- a/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java
+++ b/src/main/java/net/snowflake/client/core/auth/AuthenticatorType.java
@@ -41,5 +41,20 @@ public enum AuthenticatorType {
   /*
    * Authenticator to enable token for regular login with mfa
    */
-  USERNAME_PASSWORD_MFA
+  USERNAME_PASSWORD_MFA,
+
+  /*
+   * Authorization code flow with browser popup
+   */
+  OAUTH_AUTHORIZATION_CODE,
+
+  /*
+   * Client credentials flow with clientId and clientSecret as input
+   */
+  OAUTH_CLIENT_CREDENTIALS,
+
+  /*
+   * Authenticator to support PAT created in Snowflake
+   */
+  PROGRAMMATIC_ACCESS_TOKEN
 }
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/AccessTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/AccessTokenProvider.java
new file mode 100644
index 000000000..2c8a36108
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/AccessTokenProvider.java
@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+public interface AccessTokenProvider {
+
+  TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException;
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandler.java b/src/main/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandler.java
new file mode 100644
index 000000000..e890ebce5
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandler.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.amazonaws.util.StringUtils;
+import com.nimbusds.oauth2.sdk.id.State;
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpHandler;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.stream.Collectors;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.utils.URLEncodedUtils;
+
+class AuthorizationCodeRedirectRequestHandler implements HttpHandler {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(AuthorizationCodeRedirectRequestHandler.class);
+
+  private final CompletableFuture<String> authorizationCodeFuture;
+  private final State expectedState;
+
+  AuthorizationCodeRedirectRequestHandler(
+      CompletableFuture<String> authorizationCodeFuture, State expectedState) {
+    this.authorizationCodeFuture = authorizationCodeFuture;
+    this.expectedState = expectedState;
+  }
+
+  @Override
+  public void handle(HttpExchange exchange) throws IOException {
+    Map<String, String> urlParams =
+        URLEncodedUtils.parse(exchange.getRequestURI(), StandardCharsets.UTF_8).stream()
+            .collect(Collectors.toMap(NameValuePair::getName, NameValuePair::getValue));
+    String response = handleRedirectRequest(urlParams, authorizationCodeFuture, expectedState);
+    exchange.sendResponseHeaders(200, response.length());
+    exchange.getResponseBody().write(response.getBytes(StandardCharsets.UTF_8));
+    exchange.getResponseBody().close();
+  }
+
+  static String handleRedirectRequest(
+      Map<String, String> urlParams,
+      CompletableFuture<String> authorizationCodeFuture,
+      State expectedState) {
+    String response;
+    if (urlParams.containsKey("error")) {
+      response = "Authorization error: " + urlParams.get("error");
+      authorizationCodeFuture.completeExceptionally(
+          new SFException(
+              ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+              String.format(
+                  "Error during authorization: %s, %s",
+                  urlParams.get("error"), urlParams.get("error_description"))));
+    } else if (!expectedState.getValue().equals(urlParams.get("state"))) {
+      authorizationCodeFuture.completeExceptionally(
+          new SFException(
+              ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+              String.format(
+                  "Invalid authorization request redirection state: %s, expected: %s",
+                  urlParams.get("state"), expectedState.getValue())));
+      response = "Authorization error: invalid authorization request redirection state";
+    } else {
+      String authorizationCode = urlParams.get("code");
+      if (!StringUtils.isNullOrEmpty(authorizationCode)) {
+        logger.debug("Received authorization code on redirect URI");
+        response = "Authorization completed successfully.";
+        authorizationCodeFuture.complete(authorizationCode);
+      } else {
+        authorizationCodeFuture.completeExceptionally(
+            new SFException(
+                ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+                String.format(
+                    "Authorization code redirect URI server received request without authorization code; queryParams: %s",
+                    urlParams)));
+        response = "Authorization error: authorization code has not been returned to the driver.";
+      }
+    }
+    return response;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenForRefreshTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenForRefreshTokenProvider.java
new file mode 100644
index 000000000..9415dfbaa
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenForRefreshTokenProvider.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import java.net.URI;
+import net.snowflake.client.core.HttpUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthAccessTokenForRefreshTokenProvider implements AccessTokenProvider {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthClientCredentialsAccessTokenProvider.class);
+
+  private static final ObjectMapper objectMapper = new ObjectMapper();
+
+  @Override
+  public TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException {
+    try {
+      logger.debug("Obtaining new OAuth access token using refresh token...");
+      TokenRequest tokenRequest = buildTokenRequest(loginInput);
+      return requestForAccessToken(loginInput, tokenRequest);
+    } catch (Exception e) {
+      logger.error("Error during OAuth refresh token flow.", e);
+      throw new SFException(e, ErrorCode.OAUTH_REFRESH_TOKEN_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private TokenResponseDTO requestForAccessToken(SFLoginInput loginInput, TokenRequest tokenRequest)
+      throws Exception {
+    URI requestUri = tokenRequest.getEndpointURI();
+    logger.debug(
+        "Requesting new OAuth access token from: {}{}",
+        requestUri.getAuthority(),
+        requestUri.getPath());
+    String tokenResponse =
+        HttpUtil.executeGeneralRequest(
+            OAuthUtil.convertToBaseAuthorizationRequest(tokenRequest.toHTTPRequest()),
+            loginInput.getLoginTimeout(),
+            loginInput.getAuthTimeout(),
+            loginInput.getSocketTimeoutInMillis(),
+            0,
+            loginInput.getHttpClientSettingsKey());
+    TokenResponseDTO tokenResponseDTO =
+        objectMapper.readValue(tokenResponse, TokenResponseDTO.class);
+    logger.debug(
+        "Received new OAuth access token from: {}{}",
+        requestUri.getAuthority(),
+        requestUri.getPath());
+    return tokenResponseDTO;
+  }
+
+  private static TokenRequest buildTokenRequest(SFLoginInput loginInput) {
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput.getOauthLoginInput(), loginInput.getServerUrl());
+    ClientAuthentication clientAuthentication =
+        new ClientSecretBasic(
+            new ClientID(loginInput.getOauthLoginInput().getClientId()),
+            new Secret(loginInput.getOauthLoginInput().getClientSecret()));
+    Scope scope =
+        new Scope(OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole()));
+    RefreshToken refreshToken = new RefreshToken(loginInput.getOauthRefreshToken());
+    return new TokenRequest(
+        tokenRequestUrl, clientAuthentication, new RefreshTokenGrant(refreshToken), scope);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactory.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactory.java
new file mode 100644
index 000000000..f9055dd34
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactory.java
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+import net.snowflake.client.core.AssertUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SessionUtilExternalBrowser;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthAccessTokenProviderFactory {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthAccessTokenProviderFactory.class);
+  private static final Set<AuthenticatorType> ELIGIBLE_AUTH_TYPES =
+      new HashSet<>(
+          Arrays.asList(
+              AuthenticatorType.OAUTH_AUTHORIZATION_CODE,
+              AuthenticatorType.OAUTH_CLIENT_CREDENTIALS));
+
+  private final SessionUtilExternalBrowser.AuthExternalBrowserHandlers browserHandler;
+  private final long browserAuthorizationTimeoutSeconds;
+
+  public OAuthAccessTokenProviderFactory(
+      SessionUtilExternalBrowser.AuthExternalBrowserHandlers browserHandler,
+      long browserAuthorizationTimeoutSeconds) {
+    this.browserHandler = browserHandler;
+    this.browserAuthorizationTimeoutSeconds = browserAuthorizationTimeoutSeconds;
+  }
+
+  public AccessTokenProvider createAccessTokenProvider(
+      AuthenticatorType authenticatorType, SFLoginInput loginInput) throws SFException {
+    switch (authenticatorType) {
+      case OAUTH_AUTHORIZATION_CODE:
+        assertContainsClientCredentials(loginInput, authenticatorType);
+        validateHttpRedirectUriIfSpecified(loginInput);
+        return new OAuthAuthorizationCodeAccessTokenProvider(
+            browserHandler, new RandomStateProvider(), browserAuthorizationTimeoutSeconds);
+      case OAUTH_CLIENT_CREDENTIALS:
+        assertContainsClientCredentials(loginInput, authenticatorType);
+        AssertUtil.assertTrue(
+            loginInput.getOauthLoginInput().getExternalTokenRequestUrl() != null,
+            "passing externalTokenRequestUrl is required for OAUTH_CLIENT_CREDENTIALS authentication");
+        return new OAuthClientCredentialsAccessTokenProvider();
+      default:
+        logger.error("Unsupported authenticator type: " + authenticatorType);
+        throw new SFException(ErrorCode.INTERNAL_ERROR);
+    }
+  }
+
+  private void validateHttpRedirectUriIfSpecified(SFLoginInput loginInput) throws SFException {
+    String redirectUri = loginInput.getOauthLoginInput().getRedirectUri();
+    if (redirectUri != null) {
+      AssertUtil.assertTrue(
+          !redirectUri.startsWith("https"),
+          "provided redirect URI should start with \"http\", not \"https\"");
+    }
+  }
+
+  public static boolean isEligible(AuthenticatorType authenticatorType) {
+    return getEligible().contains(authenticatorType);
+  }
+
+  private static Set<AuthenticatorType> getEligible() {
+    return ELIGIBLE_AUTH_TYPES;
+  }
+
+  private void assertContainsClientCredentials(
+      SFLoginInput loginInput, AuthenticatorType authenticatorType) throws SFException {
+    AssertUtil.assertTrue(
+        loginInput.getOauthLoginInput().getClientId() != null,
+        String.format(
+            "passing clientId is required for %s authentication", authenticatorType.name()));
+    AssertUtil.assertTrue(
+        loginInput.getOauthLoginInput().getClientSecret() != null,
+        String.format(
+            "passing clientSecret is required for %s authentication", authenticatorType.name()));
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAuthorizationCodeAccessTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAuthorizationCodeAccessTokenProvider.java
new file mode 100644
index 000000000..f40253b72
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthAuthorizationCodeAccessTokenProvider.java
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import static net.snowflake.client.core.SessionUtilExternalBrowser.AuthExternalBrowserHandlers;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.AuthorizationCode;
+import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
+import com.nimbusds.oauth2.sdk.AuthorizationGrant;
+import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.ResponseType;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.id.State;
+import com.nimbusds.oauth2.sdk.pkce.CodeChallengeMethod;
+import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
+import com.sun.net.httpserver.HttpServer;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import net.snowflake.client.core.HttpUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SFOauthLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthAuthorizationCodeAccessTokenProvider implements AccessTokenProvider {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthAuthorizationCodeAccessTokenProvider.class);
+
+  static final String DEFAULT_REDIRECT_HOST = "http://127.0.0.1";
+  static final String DEFAULT_REDIRECT_URI_ENDPOINT = "/";
+  private static final ObjectMapper objectMapper = new ObjectMapper();
+
+  private final AuthExternalBrowserHandlers browserHandler;
+  private final StateProvider<String> stateProvider;
+  private final long browserAuthorizationTimeoutSeconds;
+
+  public OAuthAuthorizationCodeAccessTokenProvider(
+      AuthExternalBrowserHandlers browserHandler,
+      StateProvider<String> stateProvider,
+      long browserAuthorizationTimeoutSeconds) {
+    this.browserHandler = browserHandler;
+    this.stateProvider = stateProvider;
+    this.browserAuthorizationTimeoutSeconds = browserAuthorizationTimeoutSeconds;
+  }
+
+  @Override
+  public TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException {
+    try {
+      logger.debug("Starting OAuth authorization code authentication flow...");
+      CodeVerifier pkceVerifier = new CodeVerifier();
+      URI redirectUri = OAuthUtil.buildRedirectUri(loginInput.getOauthLoginInput());
+      AuthorizationCode authorizationCode =
+          requestAuthorizationCode(loginInput, pkceVerifier, redirectUri);
+      return exchangeAuthorizationCodeForAccessToken(
+          loginInput, authorizationCode, pkceVerifier, redirectUri);
+    } catch (Exception e) {
+      logger.error(
+          "Error during OAuth authorization code flow. Verify configuration passed to driver and IdP (URLs, grant types, scope, etc.)",
+          e);
+      throw new SFException(e, ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private AuthorizationCode requestAuthorizationCode(
+      SFLoginInput loginInput, CodeVerifier pkceVerifier, URI redirectUri)
+      throws SFException, IOException {
+    State state = new State(stateProvider.getState());
+    AuthorizationRequest request =
+        buildAuthorizationRequest(loginInput, pkceVerifier, state, redirectUri);
+    URI authorizeRequestURI = request.toURI();
+    HttpServer httpServer = createHttpServer(redirectUri);
+    CompletableFuture<String> codeFuture =
+        setupRedirectURIServerForAuthorizationCode(httpServer, state);
+    logger.debug("Waiting for authorization code redirection to {}...", redirectUri);
+    return letUserAuthorize(authorizeRequestURI, codeFuture, httpServer);
+  }
+
+  private TokenResponseDTO exchangeAuthorizationCodeForAccessToken(
+      SFLoginInput loginInput,
+      AuthorizationCode authorizationCode,
+      CodeVerifier pkceVerifier,
+      URI redirectUri)
+      throws SFException {
+    try {
+      TokenRequest request =
+          buildTokenRequest(loginInput, authorizationCode, pkceVerifier, redirectUri);
+      URI requestUri = request.getEndpointURI();
+      logger.debug(
+          "Requesting OAuth access token from: {}",
+          requestUri.getAuthority() + requestUri.getPath());
+      String tokenResponse =
+          HttpUtil.executeGeneralRequest(
+              OAuthUtil.convertToBaseAuthorizationRequest(request.toHTTPRequest()),
+              loginInput.getLoginTimeout(),
+              loginInput.getAuthTimeout(),
+              loginInput.getSocketTimeoutInMillis(),
+              0,
+              loginInput.getHttpClientSettingsKey());
+      TokenResponseDTO tokenResponseDTO =
+          objectMapper.readValue(tokenResponse, TokenResponseDTO.class);
+      logger.debug(
+          "Received OAuth access token from: {}{}",
+          requestUri.getAuthority(),
+          requestUri.getPath());
+      return tokenResponseDTO;
+    } catch (Exception e) {
+      logger.error("Error during making OAuth access token request", e);
+      throw new SFException(e, ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private AuthorizationCode letUserAuthorize(
+      URI authorizeRequestURI, CompletableFuture<String> codeFuture, HttpServer httpServer)
+      throws SFException {
+    try {
+      logger.debug(
+          "Opening browser for authorization code request to: {}",
+          authorizeRequestURI.getAuthority() + authorizeRequestURI.getPath());
+      browserHandler.openBrowser(authorizeRequestURI.toString());
+      String code = codeFuture.get(this.browserAuthorizationTimeoutSeconds, TimeUnit.SECONDS);
+      return new AuthorizationCode(code);
+    } catch (TimeoutException e) {
+      throw new SFException(
+          e,
+          ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR,
+          "Authorization request timed out. Snowflake driver did not receive authorization code back to the redirect URI. Verify your security integration and driver configuration.");
+    } catch (Exception e) {
+      throw new SFException(e, ErrorCode.OAUTH_AUTHORIZATION_CODE_FLOW_ERROR, e.getMessage());
+    } finally {
+      logger.debug("Stopping OAuth redirect URI server @ {}", httpServer.getAddress());
+      httpServer.stop(10);
+    }
+  }
+
+  private static CompletableFuture<String> setupRedirectURIServerForAuthorizationCode(
+      HttpServer httpServer, State expectedState) {
+    CompletableFuture<String> authorizationCodeFuture = new CompletableFuture<>();
+    httpServer.createContext(
+        DEFAULT_REDIRECT_URI_ENDPOINT,
+        new AuthorizationCodeRedirectRequestHandler(authorizationCodeFuture, expectedState));
+    logger.debug("Starting OAuth redirect URI server @ {}", httpServer.getAddress());
+    httpServer.start();
+    return authorizationCodeFuture;
+  }
+
+  private static HttpServer createHttpServer(URI redirectUri) throws IOException {
+    return HttpServer.create(
+        new InetSocketAddress(redirectUri.getHost(), redirectUri.getPort()), 0);
+  }
+
+  private static AuthorizationRequest buildAuthorizationRequest(
+      SFLoginInput loginInput, CodeVerifier pkceVerifier, State state, URI redirectUri) {
+    SFOauthLoginInput oauthLoginInput = loginInput.getOauthLoginInput();
+    ClientID clientID = new ClientID(oauthLoginInput.getClientId());
+    String scope = OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole());
+    return new AuthorizationRequest.Builder(new ResponseType(ResponseType.Value.CODE), clientID)
+        .scope(new Scope(scope))
+        .state(state)
+        .redirectionURI(redirectUri)
+        .codeChallenge(pkceVerifier, CodeChallengeMethod.S256)
+        .endpointURI(
+            OAuthUtil.getAuthorizationUrl(
+                loginInput.getOauthLoginInput(), loginInput.getServerUrl()))
+        .build();
+  }
+
+  private static TokenRequest buildTokenRequest(
+      SFLoginInput loginInput,
+      AuthorizationCode authorizationCode,
+      CodeVerifier pkceVerifier,
+      URI redirectUri) {
+    AuthorizationGrant codeGrant =
+        new AuthorizationCodeGrant(authorizationCode, redirectUri, pkceVerifier);
+    ClientAuthentication clientAuthentication =
+        new ClientSecretBasic(
+            new ClientID(loginInput.getOauthLoginInput().getClientId()),
+            new Secret(loginInput.getOauthLoginInput().getClientSecret()));
+    Scope scope =
+        new Scope(OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole()));
+    return new TokenRequest(
+        OAuthUtil.getTokenRequestUrl(loginInput.getOauthLoginInput(), loginInput.getServerUrl()),
+        clientAuthentication,
+        codeGrant,
+        scope);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthClientCredentialsAccessTokenProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthClientCredentialsAccessTokenProvider.java
new file mode 100644
index 000000000..79dc87b61
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthClientCredentialsAccessTokenProvider.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.ClientCredentialsGrant;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import java.net.URI;
+import net.snowflake.client.core.HttpUtil;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+import net.snowflake.client.jdbc.ErrorCode;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+
+@SnowflakeJdbcInternalApi
+public class OAuthClientCredentialsAccessTokenProvider implements AccessTokenProvider {
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthClientCredentialsAccessTokenProvider.class);
+
+  private static final ObjectMapper objectMapper = new ObjectMapper();
+
+  @Override
+  public TokenResponseDTO getAccessToken(SFLoginInput loginInput) throws SFException {
+    try {
+      logger.debug("Starting OAuth authorization code authentication flow...");
+      TokenRequest tokenRequest = buildTokenRequest(loginInput);
+      return requestForAccessToken(loginInput, tokenRequest);
+    } catch (Exception e) {
+      logger.error(
+          "Error during OAuth client credentials code flow. Verify configuration passed to driver and IdP (URLs, grant types, scope, etc.)",
+          e);
+      throw new SFException(e, ErrorCode.OAUTH_CLIENT_CREDENTIALS_FLOW_ERROR, e.getMessage());
+    }
+  }
+
+  private TokenResponseDTO requestForAccessToken(SFLoginInput loginInput, TokenRequest tokenRequest)
+      throws Exception {
+    URI requestUri = tokenRequest.getEndpointURI();
+    logger.debug(
+        "Requesting OAuth access token from: {}{}",
+        requestUri.getAuthority(),
+        requestUri.getPath());
+    String tokenResponse =
+        HttpUtil.executeGeneralRequest(
+            OAuthUtil.convertToBaseAuthorizationRequest(tokenRequest.toHTTPRequest()),
+            loginInput.getLoginTimeout(),
+            loginInput.getAuthTimeout(),
+            loginInput.getSocketTimeoutInMillis(),
+            0,
+            loginInput.getHttpClientSettingsKey());
+    TokenResponseDTO tokenResponseDTO =
+        objectMapper.readValue(tokenResponse, TokenResponseDTO.class);
+    logger.debug(
+        "Received OAuth access token from: {}", requestUri.getAuthority() + requestUri.getPath());
+    return tokenResponseDTO;
+  }
+
+  private static TokenRequest buildTokenRequest(SFLoginInput loginInput) {
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput.getOauthLoginInput(), loginInput.getServerUrl());
+    ClientAuthentication clientAuthentication =
+        new ClientSecretBasic(
+            new ClientID(loginInput.getOauthLoginInput().getClientId()),
+            new Secret(loginInput.getOauthLoginInput().getClientSecret()));
+    Scope scope =
+        new Scope(OAuthUtil.getScope(loginInput.getOauthLoginInput(), loginInput.getRole()));
+    return new TokenRequest(
+        tokenRequestUrl, clientAuthentication, new ClientCredentialsGrant(), scope);
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/OAuthUtil.java b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthUtil.java
new file mode 100644
index 000000000..a61ad9e29
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/OAuthUtil.java
@@ -0,0 +1,69 @@
+package net.snowflake.client.core.auth.oauth;
+
+import static net.snowflake.client.core.auth.oauth.OAuthAuthorizationCodeAccessTokenProvider.DEFAULT_REDIRECT_HOST;
+import static net.snowflake.client.core.auth.oauth.OAuthAuthorizationCodeAccessTokenProvider.DEFAULT_REDIRECT_URI_ENDPOINT;
+
+import com.amazonaws.util.StringUtils;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import net.snowflake.client.core.SFOauthLoginInput;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpRequestBase;
+import org.apache.http.entity.StringEntity;
+
+class OAuthUtil {
+
+  private static final String SNOWFLAKE_AUTHORIZE_ENDPOINT = "/oauth/authorize";
+  private static final String SNOWFLAKE_TOKEN_REQUEST_ENDPOINT = "/oauth/token-request";
+
+  private static final String DEFAULT_SESSION_ROLE_SCOPE_PREFIX = "session:role:";
+
+  static HttpRequestBase convertToBaseAuthorizationRequest(HTTPRequest request) {
+    HttpPost baseRequest = new HttpPost(request.getURI());
+    baseRequest.setEntity(new StringEntity(request.getBody(), StandardCharsets.UTF_8));
+    request
+        .getHeaderMap()
+        .forEach((key, values) -> values.forEach(value -> baseRequest.addHeader(key, value)));
+    return baseRequest;
+  }
+
+  static URI getAuthorizationUrl(SFOauthLoginInput oauthLoginInput, String serverUrl) {
+    URI uri =
+        !StringUtils.isNullOrEmpty(oauthLoginInput.getExternalAuthorizationUrl())
+            ? URI.create(oauthLoginInput.getExternalAuthorizationUrl())
+            : URI.create(serverUrl + SNOWFLAKE_AUTHORIZE_ENDPOINT);
+    return uri.normalize();
+  }
+
+  static URI getTokenRequestUrl(SFOauthLoginInput oauthLoginInput, String serverUrl) {
+    URI uri =
+        !StringUtils.isNullOrEmpty(oauthLoginInput.getExternalTokenRequestUrl())
+            ? URI.create(oauthLoginInput.getExternalTokenRequestUrl())
+            : URI.create(serverUrl + SNOWFLAKE_TOKEN_REQUEST_ENDPOINT);
+    return uri.normalize();
+  }
+
+  static String getScope(SFOauthLoginInput oauthLoginInput, String role) {
+    return (!StringUtils.isNullOrEmpty(oauthLoginInput.getScope()))
+        ? oauthLoginInput.getScope()
+        : DEFAULT_SESSION_ROLE_SCOPE_PREFIX + role;
+  }
+
+  static URI buildRedirectUri(SFOauthLoginInput oauthLoginInput) throws IOException {
+    String redirectUri =
+        !StringUtils.isNullOrEmpty(oauthLoginInput.getRedirectUri())
+            ? oauthLoginInput.getRedirectUri()
+            : createDefaultRedirectUri();
+    return URI.create(redirectUri);
+  }
+
+  private static String createDefaultRedirectUri() throws IOException {
+    try (ServerSocket socket = new ServerSocket(0)) {
+      return String.format(
+          "%s:%s%s", DEFAULT_REDIRECT_HOST, socket.getLocalPort(), DEFAULT_REDIRECT_URI_ENDPOINT);
+    }
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/RandomStateProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/RandomStateProvider.java
new file mode 100644
index 000000000..71b8a9803
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/RandomStateProvider.java
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.nimbusds.oauth2.sdk.id.State;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+public class RandomStateProvider implements StateProvider<String> {
+  @Override
+  public String getState() {
+    return new State(256).getValue();
+  }
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/StateProvider.java b/src/main/java/net/snowflake/client/core/auth/oauth/StateProvider.java
new file mode 100644
index 000000000..a9c35e9b2
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/StateProvider.java
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+public interface StateProvider<T> {
+  T getState();
+}
diff --git a/src/main/java/net/snowflake/client/core/auth/oauth/TokenResponseDTO.java b/src/main/java/net/snowflake/client/core/auth/oauth/TokenResponseDTO.java
new file mode 100644
index 000000000..90e848582
--- /dev/null
+++ b/src/main/java/net/snowflake/client/core/auth/oauth/TokenResponseDTO.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
+
+@SnowflakeJdbcInternalApi
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class TokenResponseDTO {
+
+  private final String accessToken;
+  private final String refreshToken;
+  private final String tokenType;
+  private final String scope;
+  private final String username;
+  private final boolean idpInitiated;
+  private final long expiresIn;
+  private final long refreshTokenExpiresIn;
+
+  @JsonCreator(mode = JsonCreator.Mode.PROPERTIES)
+  public TokenResponseDTO(
+      @JsonProperty("access_token") String accessToken,
+      @JsonProperty("refresh_token") String refreshToken,
+      @JsonProperty("token_type") String tokenType,
+      @JsonProperty("scope") String scope,
+      @JsonProperty("username") String username,
+      @JsonProperty("idp_initiated") boolean idpInitiated,
+      @JsonProperty("expires_in") long expiresIn,
+      @JsonProperty("refresh_token_expires_in") long refreshTokenExpiresIn) {
+    this.accessToken = accessToken;
+    this.tokenType = tokenType;
+    this.refreshToken = refreshToken;
+    this.scope = scope;
+    this.username = username;
+    this.idpInitiated = idpInitiated;
+    this.expiresIn = expiresIn;
+    this.refreshTokenExpiresIn = refreshTokenExpiresIn;
+  }
+
+  public String getAccessToken() {
+    return accessToken;
+  }
+
+  public String getTokenType() {
+    return tokenType;
+  }
+
+  public String getRefreshToken() {
+    return refreshToken;
+  }
+
+  public String getScope() {
+    return scope;
+  }
+
+  public long getExpiresIn() {
+    return expiresIn;
+  }
+
+  public String getUsername() {
+    return username;
+  }
+
+  public long getRefreshTokenExpiresIn() {
+    return refreshTokenExpiresIn;
+  }
+
+  public boolean isIdpInitiated() {
+    return idpInitiated;
+  }
+}
diff --git a/src/main/java/net/snowflake/client/jdbc/ErrorCode.java b/src/main/java/net/snowflake/client/jdbc/ErrorCode.java
index b9cc71491..33df40657 100644
--- a/src/main/java/net/snowflake/client/jdbc/ErrorCode.java
+++ b/src/main/java/net/snowflake/client/jdbc/ErrorCode.java
@@ -83,7 +83,10 @@ public enum ErrorCode {
   INVALID_OKTA_USERNAME(200060, SqlState.CONNECTION_EXCEPTION),
   GCP_SERVICE_ERROR(200061, SqlState.SYSTEM_ERROR),
   AUTHENTICATOR_REQUEST_TIMEOUT(200062, SqlState.CONNECTION_EXCEPTION),
-  INVALID_STRUCT_DATA(200063, SqlState.DATA_EXCEPTION);
+  INVALID_STRUCT_DATA(200063, SqlState.DATA_EXCEPTION),
+  OAUTH_AUTHORIZATION_CODE_FLOW_ERROR(200064, SqlState.CONNECTION_EXCEPTION),
+  OAUTH_CLIENT_CREDENTIALS_FLOW_ERROR(200065, SqlState.CONNECTION_EXCEPTION),
+  OAUTH_REFRESH_TOKEN_FLOW_ERROR(200066, SqlState.CONNECTION_EXCEPTION);
 
   public static final String errorMessageResource = "net.snowflake.client.jdbc.jdbc_error_messages";
 
diff --git a/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java b/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java
index fbfa84676..cf0c44291 100644
--- a/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java
+++ b/src/main/java/net/snowflake/client/jdbc/SnowflakeUtil.java
@@ -5,6 +5,7 @@
 package net.snowflake.client.jdbc;
 
 import static java.util.Arrays.stream;
+import static net.snowflake.client.core.Constants.OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE;
 import static net.snowflake.client.jdbc.SnowflakeType.GEOGRAPHY;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
@@ -170,6 +171,7 @@ private static void checkErrorAndThrowExceptionSub(
         case MASTER_EXPIRED_GS_CODE:
         case MASTER_TOKEN_INVALID_GS_CODE:
         case ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE:
+        case OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE:
           throw new SnowflakeReauthenticationRequest(queryId, errorMessage, sqlState, errorCode);
       }
     }
diff --git a/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties b/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties
index 3b68fbf69..4b5b9895c 100644
--- a/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties
+++ b/src/main/resources/net/snowflake/client/jdbc/jdbc_error_messages.properties
@@ -82,4 +82,6 @@ Error message={3}, Extended error info={4}
 200061=GCS operation failed: Operation={0}, Error code={1}, Message={2}, Reason={3}
 200062=Authentication timed out.
 200063=Invalid data - Cannot be parsed and converted to structured type.
-
+200064=Error during OAuth Authorization Code authentication: {0}
+200065=Error during OAuth Client Credentials authentication: {0}
+200066=Error during obtaining OAuth access token using refresh token: {0}
diff --git a/src/test/java/net/snowflake/client/core/CredentialManagerTest.java b/src/test/java/net/snowflake/client/core/CredentialManagerTest.java
new file mode 100644
index 000000000..7a41a7cf4
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/CredentialManagerTest.java
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class CredentialManagerTest {
+
+  public static final String SNOWFLAKE_HOST = "some-account.us-west-2.aws.snowflakecomputing.com";
+  public static final String EXTERNAL_OAUTH_HOST = "some-external-oauth-host.com";
+  public static final String SOME_ACCESS_TOKEN = "some-oauth-access-token";
+  public static final String SOME_REFRESH_TOKEN = "some-refresh-token";
+  public static final String SOME_ID_TOKEN_FROM_CACHE = "some-id-token";
+  public static final String SOME_MFA_TOKEN_FROM_CACHE = "some-mfa-token";
+  public static final String SOME_USER = "some-user";
+
+  public static final String ACCESS_TOKEN_FROM_CACHE = "access-token-from-cache";
+  public static final String REFRESH_TOKEN_FROM_CACHE = "refresh-token-from-cache";
+  public static final String EXTERNAL_ACCESS_TOKEN_FROM_CACHE = "external-access-token-from-cache";
+  public static final String EXTERNAL_REFRESH_TOKEN_FROM_CACHE =
+      "external-refresh-token-from-cache";
+
+  private static final SecureStorageManager mockSecureStorageManager =
+      mock(SecureStorageManager.class);
+
+  @BeforeAll
+  public static void setUp() {
+    CredentialManager.injectSecureStorageManager(mockSecureStorageManager);
+  }
+
+  @AfterAll
+  public static void tearDown() {
+    CredentialManager.resetSecureStorageManager();
+  }
+
+  @Test
+  public void shouldCreateHostBasedOnExternalIdpUrl() throws SFException {
+    SFLoginInput loginInput = createLoginInputWithExternalOAuth();
+    String host = CredentialManager.getHostForOAuthCacheKey(loginInput);
+    assertEquals(EXTERNAL_OAUTH_HOST, host);
+  }
+
+  @Test
+  public void shouldCreateHostBasedOnSnowflakeServerUrl() throws SFException {
+    SFLoginInput loginInput = createLoginInputWithSnowflakeServer();
+    String host = CredentialManager.getHostForOAuthCacheKey(loginInput);
+    assertEquals(SNOWFLAKE_HOST, host);
+  }
+
+  @Test
+  public void shouldProperlyWriteTokensToCache() throws SFException {
+    SFLoginInput loginInputSnowflakeOAuth = createLoginInputWithSnowflakeServer();
+    CredentialManager.writeIdToken(loginInputSnowflakeOAuth, SOME_ID_TOKEN_FROM_CACHE);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.ID_TOKEN.getValue(),
+            SOME_ID_TOKEN_FROM_CACHE);
+    CredentialManager.writeMfaToken(loginInputSnowflakeOAuth, SOME_MFA_TOKEN_FROM_CACHE);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.MFA_TOKEN.getValue(),
+            SOME_MFA_TOKEN_FROM_CACHE);
+
+    CredentialManager.writeOAuthAccessToken(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue(),
+            SOME_ACCESS_TOKEN);
+    CredentialManager.writeOAuthRefreshToken(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            SNOWFLAKE_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue(),
+            SOME_REFRESH_TOKEN);
+
+    SFLoginInput loginInputExternalOAuth = createLoginInputWithExternalOAuth();
+    CredentialManager.writeOAuthAccessToken(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            EXTERNAL_OAUTH_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue(),
+            SOME_ACCESS_TOKEN);
+    CredentialManager.writeOAuthRefreshToken(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .setCredential(
+            EXTERNAL_OAUTH_HOST,
+            SOME_USER,
+            CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue(),
+            SOME_REFRESH_TOKEN);
+  }
+
+  @Test
+  public void shouldProperlyDeleteTokensFromCache() throws SFException {
+    SFLoginInput loginInputSnowflakeOAuth = createLoginInputWithSnowflakeServer();
+    CredentialManager.deleteIdTokenCache(
+        loginInputSnowflakeOAuth.getHostFromServerUrl(), loginInputSnowflakeOAuth.getUserName());
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.ID_TOKEN.getValue());
+    CredentialManager.deleteMfaTokenCache(
+        loginInputSnowflakeOAuth.getHostFromServerUrl(), loginInputSnowflakeOAuth.getUserName());
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.MFA_TOKEN.getValue());
+
+    CredentialManager.deleteOAuthAccessTokenCache(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue());
+    CredentialManager.deleteOAuthRefreshTokenCache(loginInputSnowflakeOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue());
+
+    SFLoginInput loginInputExternalOAuth = createLoginInputWithExternalOAuth();
+    CredentialManager.deleteOAuthAccessTokenCache(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue());
+    CredentialManager.deleteOAuthRefreshTokenCache(loginInputExternalOAuth);
+    verify(mockSecureStorageManager, times(1))
+        .deleteCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue());
+  }
+
+  @Test
+  public void shouldProperlyUpdateInputWithTokensFromCache() throws SFException {
+    SFLoginInput loginInputSnowflakeOAuth = createLoginInputWithSnowflakeServer();
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.ID_TOKEN.getValue()))
+        .thenReturn(SOME_ID_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedIdToken(loginInputSnowflakeOAuth);
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.MFA_TOKEN.getValue()))
+        .thenReturn(SOME_MFA_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedMfaToken(loginInputSnowflakeOAuth);
+    assertEquals(SOME_ID_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getIdToken());
+    assertEquals(SOME_MFA_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getMfaToken());
+
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue()))
+        .thenReturn(ACCESS_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthAccessToken(loginInputSnowflakeOAuth);
+    when(mockSecureStorageManager.getCredential(
+            SNOWFLAKE_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue()))
+        .thenReturn(REFRESH_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthRefreshToken(loginInputSnowflakeOAuth);
+    assertEquals(ACCESS_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getOauthAccessToken());
+    assertEquals(REFRESH_TOKEN_FROM_CACHE, loginInputSnowflakeOAuth.getOauthRefreshToken());
+
+    SFLoginInput loginInputExternalOAuth = createLoginInputWithExternalOAuth();
+    when(mockSecureStorageManager.getCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_ACCESS_TOKEN.getValue()))
+        .thenReturn(EXTERNAL_ACCESS_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthAccessToken(loginInputExternalOAuth);
+    when(mockSecureStorageManager.getCredential(
+            EXTERNAL_OAUTH_HOST, SOME_USER, CachedCredentialType.OAUTH_REFRESH_TOKEN.getValue()))
+        .thenReturn(EXTERNAL_REFRESH_TOKEN_FROM_CACHE);
+    CredentialManager.fillCachedOAuthRefreshToken(loginInputExternalOAuth);
+    assertEquals(EXTERNAL_ACCESS_TOKEN_FROM_CACHE, loginInputExternalOAuth.getOauthAccessToken());
+    assertEquals(EXTERNAL_REFRESH_TOKEN_FROM_CACHE, loginInputExternalOAuth.getOauthRefreshToken());
+  }
+
+  private SFLoginInput createLoginInputWithExternalOAuth() {
+    SFLoginInput loginInput = createGenericLoginInput();
+    loginInput.setOauthLoginInput(
+        new SFOauthLoginInput(
+            null, null, null, null, "https://some-external-oauth-host.com/oauth/token", null));
+    return loginInput;
+  }
+
+  private SFLoginInput createLoginInputWithSnowflakeServer() {
+    SFLoginInput loginInput = createGenericLoginInput();
+    loginInput.setOauthLoginInput(new SFOauthLoginInput(null, null, null, null, null, null));
+    loginInput.setServerUrl("https://some-account.us-west-2.aws.snowflakecomputing.com:443/");
+
+    return loginInput;
+  }
+
+  private SFLoginInput createGenericLoginInput() {
+    SFLoginInput loginInput = new SFLoginInput();
+    loginInput.setOauthAccessToken(SOME_ACCESS_TOKEN);
+    loginInput.setOauthRefreshToken(SOME_REFRESH_TOKEN);
+    loginInput.setUserName(SOME_USER);
+    return loginInput;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/OAuthAuthorizationCodeFlowLatestIT.java b/src/test/java/net/snowflake/client/core/OAuthAuthorizationCodeFlowLatestIT.java
new file mode 100644
index 000000000..0662c3f28
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/OAuthAuthorizationCodeFlowLatestIT.java
@@ -0,0 +1,192 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import static net.snowflake.client.core.SessionUtilExternalBrowser.AuthExternalBrowserHandlers;
+
+import com.amazonaws.util.StringUtils;
+import java.net.URI;
+import java.time.Duration;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.oauth.AccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthAuthorizationCodeAccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.StateProvider;
+import net.snowflake.client.core.auth.oauth.TokenResponseDTO;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import net.snowflake.client.log.SFLogger;
+import net.snowflake.client.log.SFLoggerFactory;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(TestTags.CORE)
+public class OAuthAuthorizationCodeFlowLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/oauth/authorization_code";
+  private static final String SUCCESSFUL_FLOW_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/successful_flow.json";
+  private static final String BROWSER_TIMEOUT_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/browser_timeout_authorization_error.json";
+  private static final String INVALID_SCOPE_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/invalid_scope_error.json";
+  private static final String INVALID_STATE_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/invalid_state_error.json";
+  private static final String TOKEN_REQUEST_ERROR_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/token_request_error.json";
+  private static final String CUSTOM_URLS_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/external_idp_custom_urls.json";
+
+  private static final SFLogger logger =
+      SFLoggerFactory.getLogger(OAuthAuthorizationCodeFlowLatestIT.class);
+
+  private final AuthExternalBrowserHandlers wiremockProxyRequestBrowserHandler =
+      new WiremockProxyRequestBrowserHandler();
+
+  private final AccessTokenProvider provider =
+      new OAuthAuthorizationCodeAccessTokenProvider(
+          wiremockProxyRequestBrowserHandler, new MockStateProvider(), 30);
+
+  @Test
+  public void successfulFlowScenario() throws SFException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8009/snowflake/oauth-redirect", null, null);
+
+    TokenResponseDTO tokenResponse = provider.getAccessToken(loginInput);
+    String accessToken = tokenResponse.getAccessToken();
+
+    Assertions.assertFalse(StringUtils.isNullOrEmpty(accessToken));
+    Assertions.assertEquals("access-token-123", accessToken);
+  }
+
+  @Test
+  public void customUrlsScenario() throws SFException {
+    importMappingFromResources(CUSTOM_URLS_SCENARIO_MAPPINGS);
+    SFLoginInput loginInput =
+        createLoginInputStub(
+            "http://localhost:8007/snowflake/oauth-redirect",
+            String.format("http://%s:%d/authorization", WIREMOCK_HOST, wiremockHttpPort),
+            String.format("http://%s:%d/tokenrequest", WIREMOCK_HOST, wiremockHttpPort));
+
+    TokenResponseDTO tokenResponse = provider.getAccessToken(loginInput);
+    String accessToken = tokenResponse.getAccessToken();
+
+    Assertions.assertFalse(StringUtils.isNullOrEmpty(accessToken));
+    Assertions.assertEquals("access-token-123", accessToken);
+  }
+
+  @Test
+  public void browserTimeoutFlowScenario() {
+    importMappingFromResources(BROWSER_TIMEOUT_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8004/snowflake/oauth-redirect", null, null);
+
+    AccessTokenProvider provider =
+        new OAuthAuthorizationCodeAccessTokenProvider(
+            wiremockProxyRequestBrowserHandler, new MockStateProvider(), 1);
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Authorization request timed out. Snowflake driver did not receive authorization code back to the redirect URI. Verify your security integration and driver configuration."));
+  }
+
+  @Test
+  public void invalidScopeFlowScenario() {
+    importMappingFromResources(INVALID_SCOPE_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8002/snowflake/oauth-redirect", null, null);
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during authorization: invalid_scope, One or more scopes are not configured for the authorization server resource."));
+  }
+
+  @Test
+  public void invalidStateFlowScenario() {
+    importMappingFromResources(INVALID_STATE_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8010/snowflake/oauth-redirect", null, null);
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "Error during OAuth Authorization Code authentication: Invalid authorization request redirection state: invalidstate, expected: abc123"));
+  }
+
+  @Test
+  public void tokenRequestErrorFlowScenario() {
+    importMappingFromResources(TOKEN_REQUEST_ERROR_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8003/snowflake/oauth-redirect", null, null);
+
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains("JDBC driver encountered communication error. Message: HTTP status=400"));
+  }
+
+  private SFLoginInput createLoginInputStub(
+      String redirectUri, String externalAuthorizationUrl, String externalTokenUrl) {
+    SFLoginInput loginInputStub = new SFLoginInput();
+    loginInputStub.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    loginInputStub.setOauthLoginInput(
+        new SFOauthLoginInput(
+            "123",
+            "123",
+            redirectUri,
+            externalAuthorizationUrl,
+            externalTokenUrl,
+            "session:role:ANALYST"));
+    loginInputStub.setSocketTimeout(Duration.ofMinutes(5));
+    loginInputStub.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+
+    return loginInputStub;
+  }
+
+  static class WiremockProxyRequestBrowserHandler implements AuthExternalBrowserHandlers {
+    @Override
+    public HttpPost build(URI uri) {
+      // do nothing
+      return null;
+    }
+
+    @Override
+    public void openBrowser(String ssoUrl) {
+      try (CloseableHttpClient client = HttpClients.createDefault()) {
+        logger.debug("executing browser request to redirect uri: {}", ssoUrl);
+        HttpResponse response = client.execute(new HttpGet(ssoUrl));
+        if (response.getStatusLine().getStatusCode() != 200) {
+          throw new RuntimeException("Invalid response from " + ssoUrl);
+        }
+      } catch (Exception e) {
+        throw new RuntimeException(e);
+      }
+    }
+
+    @Override
+    public void output(String msg) {
+      // do nothing
+    }
+  }
+
+  static class MockStateProvider implements StateProvider<String> {
+
+    @Override
+    public String getState() {
+      return "abc123";
+    }
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/OAuthClientCredentialsFlowLatestIT.java b/src/test/java/net/snowflake/client/core/OAuthClientCredentialsFlowLatestIT.java
new file mode 100644
index 000000000..a78cc7d28
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/OAuthClientCredentialsFlowLatestIT.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import com.amazonaws.util.StringUtils;
+import java.time.Duration;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.oauth.AccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.OAuthClientCredentialsAccessTokenProvider;
+import net.snowflake.client.core.auth.oauth.TokenResponseDTO;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(TestTags.CORE)
+public class OAuthClientCredentialsFlowLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/oauth/client_credentials";
+  private static final String SUCCESSFUL_FLOW_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/successful_flow.json";
+  private static final String TOKEN_REQUEST_ERROR_SCENARIO_MAPPING =
+      SCENARIOS_BASE_DIR + "/token_request_error.json";
+
+  @Test
+  public void successfulFlowScenario() throws SFException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8009/snowflake/oauth-redirect");
+
+    AccessTokenProvider provider = new OAuthClientCredentialsAccessTokenProvider();
+    TokenResponseDTO tokenResponse = provider.getAccessToken(loginInput);
+    String accessToken = tokenResponse.getAccessToken();
+
+    Assertions.assertFalse(StringUtils.isNullOrEmpty(accessToken));
+    Assertions.assertEquals("access-token-123", accessToken);
+  }
+
+  @Test
+  public void tokenRequestErrorFlowScenario() {
+    importMappingFromResources(TOKEN_REQUEST_ERROR_SCENARIO_MAPPING);
+    SFLoginInput loginInput =
+        createLoginInputStub("http://localhost:8003/snowflake/oauth-redirect");
+
+    AccessTokenProvider provider = new OAuthClientCredentialsAccessTokenProvider();
+    SFException e =
+        Assertions.assertThrows(SFException.class, () -> provider.getAccessToken(loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains("JDBC driver encountered communication error. Message: HTTP status=400"));
+  }
+
+  private SFLoginInput createLoginInputStub(String redirectUri) {
+    SFLoginInput loginInputStub = new SFLoginInput();
+    loginInputStub.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    loginInputStub.setOauthLoginInput(
+        new SFOauthLoginInput(
+            "123",
+            "123",
+            redirectUri,
+            null,
+            String.format("http://%s:%d/oauth/token-request", WIREMOCK_HOST, wiremockHttpPort),
+            "session:role:ANALYST"));
+    loginInputStub.setSocketTimeout(Duration.ofMinutes(5));
+    loginInputStub.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+
+    return loginInputStub;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/OAuthTokenCacheLatestIT.java b/src/test/java/net/snowflake/client/core/OAuthTokenCacheLatestIT.java
new file mode 100644
index 000000000..2537e882c
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/OAuthTokenCacheLatestIT.java
@@ -0,0 +1,224 @@
+package net.snowflake.client.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+
+import java.time.Duration;
+import java.util.Collections;
+import java.util.HashMap;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import net.snowflake.client.jdbc.SnowflakeSQLException;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.MockedStatic;
+import org.mockito.stubbing.Answer;
+
+@Tag(TestTags.CORE)
+public class OAuthTokenCacheLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/oauth/token_caching";
+  private static final String CACHING_TOKENS_AFTER_CONNECTING_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/caching_tokens_after_connecting.json";
+  private static final String REUSING_CACHED_ACCESS_TOKEN_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/reusing_cached_access_token_to_authenticate.json";
+  private static final String REFRESHING_EXPIRED_ACCESS_TOKEN_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/refreshing_expired_access_token.json";
+  private static final String
+      CACHING_REFRESHED_ACCESS_TOKEN_AND_NEW_REFRESH_TOKEN_SCENARIO_MAPPINGS =
+          SCENARIOS_BASE_DIR + "/caching_refreshed_access_token_and_new_refresh_token.json";
+  private static final String RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_ERROR_WHEN_REFRESHING =
+      SCENARIOS_BASE_DIR + "/restarting_full_flow_on_refresh_token_error.json";
+  private static final String RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_NO_REFRESH_TOKEN =
+      SCENARIOS_BASE_DIR + "/restarting_full_flow_on_expiration_and_no_refresh_token.json";
+
+  @Test
+  public void shouldCacheAccessTokenAfterConnecting() throws SFException, SnowflakeSQLException {
+    importMappingFromResources(CACHING_TOKENS_AFTER_CONNECTING_SCENARIO_MAPPINGS);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      SFLoginInput loginInput = createLoginInputStub();
+      SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic, "access-token-123", "refresh-token-123");
+    }
+  }
+
+  @Test
+  public void shouldReuseCachedAccessTokenWhenConnecting()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(REUSING_CACHED_ACCESS_TOKEN_SCENARIO_MAPPINGS);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "reused-access-token-123", "reused-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+      assertEquals("reused-access-token-123", loginOutput.getOauthAccessToken());
+      assertEquals("reused-refresh-token-123", loginOutput.getOauthRefreshToken());
+    }
+  }
+
+  @Test
+  public void shouldRefreshExpiredAccessTokenAndConnectSuccessfully()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(REFRESHING_EXPIRED_ACCESS_TOKEN_SCENARIO_MAPPINGS);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "expired-access-token-123", "some-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthRefreshTokenCache(loginInput), never());
+
+      assertEquals("new-refreshed-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic,
+          "new-refreshed-access-token-123",
+          "some-refresh-token-123");
+    }
+  }
+
+  @Test
+  public void shouldCacheRefreshedAccessTokenAndNewRefreshToken()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(
+        CACHING_REFRESHED_ACCESS_TOKEN_AND_NEW_REFRESH_TOKEN_SCENARIO_MAPPINGS);
+
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "expired-access-token-123", "some-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      assertEquals("new-refreshed-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic, "new-refreshed-access-token-123", "new-refresh-token-123");
+    }
+  }
+
+  @Test
+  public void shouldRestartFullFlowOnAccessTokenExpirationAndErrorWhenRefreshing()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_ERROR_WHEN_REFRESHING);
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(
+          credentialManagerMockedStatic, "expired-access-token-123", "some-refresh-token-123");
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthRefreshTokenCache(loginInput), times(1));
+      assertEquals("newly-obtained-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic,
+          "newly-obtained-access-token-123",
+          "newly-obtained-refresh-token");
+    }
+  }
+
+  @Test
+  public void shouldRestartFullFlowOnAccessTokenExpirationAndNoRefreshToken()
+      throws SFException, SnowflakeSQLException {
+    importMappingFromResources(RESTARTING_FULL_FLOW_ON_EXPIRATION_AND_NO_REFRESH_TOKEN);
+
+    try (MockedStatic<CredentialManager> credentialManagerMockedStatic =
+        mockStatic(CredentialManager.class)) {
+      mockLoadingTokensFromCache(credentialManagerMockedStatic, "expired-access-token-123", null);
+      SFLoginInput loginInput = createLoginInputStub();
+      SFLoginOutput loginOutput = SessionUtil.openSession(loginInput, new HashMap<>(), "INFO");
+
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthAccessTokenCache(loginInput), times(1));
+      credentialManagerMockedStatic.verify(
+          () -> CredentialManager.deleteOAuthRefreshTokenCache(loginInput), never());
+      assertEquals("newly-obtained-access-token-123", loginOutput.getOauthAccessToken());
+      captureAndAssertSavedTokenValues(
+          credentialManagerMockedStatic, "newly-obtained-access-token-123", null);
+    }
+  }
+
+  private SFLoginInput createLoginInputStub() {
+    SFLoginInput input = new SFLoginInput();
+    input.setAuthenticator(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name());
+    input.setOriginalAuthenticator(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS.name());
+    input.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    input.setUserName("MOCK_USERNAME");
+    input.setAccountName("MOCK_ACCOUNT_NAME");
+    input.setAppId("MOCK_APP_ID");
+    input.setAppVersion("MOCK_APP_VERSION");
+    input.setOCSPMode(OCSPMode.FAIL_OPEN);
+    input.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+    input.setBrowserResponseTimeout(Duration.ofSeconds(20));
+    input.setLoginTimeout(1000);
+    input.setSessionParameters(Collections.singletonMap("CLIENT_STORE_TEMPORARY_CREDENTIAL", true));
+    input.setOauthLoginInput(
+        new SFOauthLoginInput(
+            "123",
+            "123",
+            null,
+            null,
+            String.format("http://%s:%d/oauth/token-request", WIREMOCK_HOST, wiremockHttpPort),
+            "session:role:ANALYST"));
+    return input;
+  }
+
+  private static void mockLoadingTokensFromCache(
+      MockedStatic<CredentialManager> credentialManagerMock,
+      String oauthAccessToken,
+      String oauthRefreshToken) {
+    Answer<Object> fillCachedOAuthAccessTokenInvocation =
+        invocation -> {
+          ((SFLoginInput) invocation.getArguments()[0]).setOauthAccessToken(oauthAccessToken);
+          return null;
+        };
+    Answer<Object> fillCachedOAuthRefreshTokenInvocation =
+        invocation -> {
+          ((SFLoginInput) invocation.getArguments()[0]).setOauthRefreshToken(oauthRefreshToken);
+          return null;
+        };
+    credentialManagerMock
+        .when(() -> CredentialManager.fillCachedOAuthAccessToken(any(SFLoginInput.class)))
+        .then(fillCachedOAuthAccessTokenInvocation);
+    credentialManagerMock
+        .when(() -> CredentialManager.fillCachedOAuthRefreshToken(any(SFLoginInput.class)))
+        .then(fillCachedOAuthRefreshTokenInvocation);
+  }
+
+  private static void captureAndAssertSavedTokenValues(
+      MockedStatic<CredentialManager> credentialManagerMock,
+      String expectedAccessToken,
+      String expectedRefreshToken) {
+    ArgumentCaptor<SFLoginInput> accessTokenInputCaptor =
+        ArgumentCaptor.forClass(SFLoginInput.class);
+    credentialManagerMock.verify(
+        () -> CredentialManager.writeOAuthAccessToken(accessTokenInputCaptor.capture()));
+    assertEquals(expectedAccessToken, accessTokenInputCaptor.getValue().getOauthAccessToken());
+
+    if (expectedRefreshToken != null) {
+      ArgumentCaptor<SFLoginInput> refreshTokenInputCaptor =
+          ArgumentCaptor.forClass(SFLoginInput.class);
+      credentialManagerMock.verify(
+          () -> CredentialManager.writeOAuthRefreshToken(refreshTokenInputCaptor.capture()));
+      assertEquals(expectedRefreshToken, refreshTokenInputCaptor.getValue().getOauthRefreshToken());
+    } else {
+      credentialManagerMock.verify(
+          () -> CredentialManager.writeOAuthRefreshToken(any(SFLoginInput.class)), never());
+    }
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/ProgrammaticAccessTokenAuthFlowLatestIT.java b/src/test/java/net/snowflake/client/core/ProgrammaticAccessTokenAuthFlowLatestIT.java
new file mode 100644
index 000000000..8573aaa2e
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/ProgrammaticAccessTokenAuthFlowLatestIT.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core;
+
+import java.util.HashMap;
+import net.snowflake.client.category.TestTags;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import net.snowflake.client.jdbc.BaseWiremockTest;
+import net.snowflake.client.jdbc.SnowflakeSQLException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(TestTags.CORE)
+public class ProgrammaticAccessTokenAuthFlowLatestIT extends BaseWiremockTest {
+
+  private static final String SCENARIOS_BASE_DIR = MAPPINGS_BASE_DIR + "/pat";
+  private static final String SUCCESSFUL_FLOW_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/successful_flow.json";
+  private static final String INVALID_TOKEN_SCENARIO_MAPPINGS =
+      SCENARIOS_BASE_DIR + "/invalid_pat_token.json";
+
+  @Test
+  public void successfulFlowScenarioPatAsToken() throws SFException, SnowflakeSQLException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInputWithPatAsToken = createLoginInputStub("MOCK_TOKEN", null);
+    SFLoginOutput loginOutput =
+        SessionUtil.newSession(loginInputWithPatAsToken, new HashMap<>(), "INFO");
+    assertSuccessfulLoginOutput(loginOutput);
+  }
+
+  @Test
+  public void successfulFlowScenarioPatAsPassword() throws SFException, SnowflakeSQLException {
+    importMappingFromResources(SUCCESSFUL_FLOW_SCENARIO_MAPPINGS);
+    SFLoginInput loginInputWithPatAsPassword = createLoginInputStub(null, "MOCK_TOKEN");
+    SFLoginOutput loginOutput =
+        SessionUtil.newSession(loginInputWithPatAsPassword, new HashMap<>(), "INFO");
+    assertSuccessfulLoginOutput(loginOutput);
+  }
+
+  @Test
+  public void invalidTokenScenario() {
+    importMappingFromResources(INVALID_TOKEN_SCENARIO_MAPPINGS);
+    SnowflakeSQLException e =
+        Assertions.assertThrows(
+            SnowflakeSQLException.class,
+            () ->
+                SessionUtil.newSession(
+                    createLoginInputStub("MOCK_TOKEN", null), new HashMap<>(), "INFO"));
+    Assertions.assertEquals("Programmatic access token is invalid.", e.getMessage());
+  }
+
+  private void assertSuccessfulLoginOutput(SFLoginOutput loginOutput) {
+    Assertions.assertNotNull(loginOutput);
+    Assertions.assertEquals("session token", loginOutput.getSessionToken());
+    Assertions.assertEquals("master token", loginOutput.getMasterToken());
+    Assertions.assertEquals(14400, loginOutput.getMasterTokenValidityInSeconds());
+    Assertions.assertEquals("8.48.0", loginOutput.getDatabaseVersion());
+    Assertions.assertEquals("TEST_DHEYMAN", loginOutput.getSessionDatabase());
+    Assertions.assertEquals("TEST_JDBC", loginOutput.getSessionSchema());
+    Assertions.assertEquals("ANALYST", loginOutput.getSessionRole());
+    Assertions.assertEquals("TEST_XSMALL", loginOutput.getSessionWarehouse());
+    Assertions.assertEquals("1172562260498", loginOutput.getSessionId());
+    Assertions.assertEquals(1, loginOutput.getCommonParams().size());
+    Assertions.assertEquals(4, loginOutput.getCommonParams().get("CLIENT_PREFETCH_THREADS"));
+  }
+
+  private SFLoginInput createLoginInputStub(String token, String password) {
+    SFLoginInput input = new SFLoginInput();
+    input.setAuthenticator(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN.name());
+    input.setServerUrl(String.format("http://%s:%d/", WIREMOCK_HOST, wiremockHttpPort));
+    input.setUserName("MOCK_USERNAME");
+    input.setAccountName("MOCK_ACCOUNT_NAME");
+    input.setAppId("MOCK_APP_ID");
+    input.setAppVersion("MOCK_APP_VERSION");
+    input.setToken(token);
+    input.setPassword(password);
+    input.setOCSPMode(OCSPMode.FAIL_OPEN);
+    input.setHttpClientSettingsKey(new HttpClientSettingsKey(OCSPMode.FAIL_OPEN));
+    input.setLoginTimeout(1000);
+    input.setSessionParameters(new HashMap<>());
+    return input;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/SessionUtilTest.java b/src/test/java/net/snowflake/client/core/SessionUtilTest.java
index 86819dc5b..b3b780855 100644
--- a/src/test/java/net/snowflake/client/core/SessionUtilTest.java
+++ b/src/test/java/net/snowflake/client/core/SessionUtilTest.java
@@ -8,7 +8,9 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mockStatic;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.BooleanNode;
 import java.io.IOException;
 import java.net.URI;
@@ -17,12 +19,16 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import net.snowflake.client.core.auth.AuthenticatorType;
 import net.snowflake.client.jdbc.MockConnectionTest;
+import net.snowflake.client.jdbc.SnowflakeUtil;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.client.utils.URIBuilder;
 import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
 
 public class SessionUtilTest {
   private static String originalUrlValue;
@@ -180,6 +186,97 @@ public void shouldDerivePrivateLinkOcspCacheServerUrlBasedOnHost() throws IOExce
         SFTrustManager.SF_OCSP_RESPONSE_CACHE_SERVER_RETRY_URL_PATTERN);
   }
 
+  @Test
+  public void testGetCommonParams() throws Exception {
+    ObjectMapper mapper = ObjectMapperFactory.getObjectMapper();
+
+    // Test unknown param name
+    Map<String, Object> result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": true}]"));
+    assertTrue((boolean) result.get("testParam"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": false}]"));
+    assertFalse((boolean) result.get("testParam"));
+
+    result =
+        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"testParam\", \"value\": 0}]"));
+    assertEquals(0, (int) result.get("testParam"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": 1000}]"));
+    assertEquals(1000, (int) result.get("testParam"));
+
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"\"}]"));
+    assertEquals("", result.get("testParam"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"value\"}]"));
+    assertEquals("value", result.get("testParam"));
+
+    // Test known param name
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": true}]"));
+    assertTrue((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": false}]"));
+    assertFalse((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
+
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree(
+                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 0}]"));
+    assertEquals(0, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree(
+                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 1000}]"));
+    assertEquals(1000, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
+
+    result =
+        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"\"}]"));
+    assertEquals("", result.get("TIMEZONE"));
+    result =
+        SessionUtil.getCommonParams(
+            mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"value\"}]"));
+    assertEquals("value", result.get("TIMEZONE"));
+  }
+
+  @Test
+  public void shouldProperlyCheckIfSoteriaEnabled() {
+    try (MockedStatic<SnowflakeUtil> snowflakeUtilMockedStatic = mockStatic(SnowflakeUtil.class)) {
+      snowflakeUtilMockedStatic
+          .when(() -> SnowflakeUtil.systemGetProperty("snowflake.jdbc.enableSoteria"))
+          .thenReturn(null);
+      Assertions.assertThrows(
+          SFException.class,
+          () -> SessionUtil.checkIfSoteriaAuthnEnabled(AuthenticatorType.OAUTH_AUTHORIZATION_CODE));
+      Assertions.assertThrows(
+          SFException.class,
+          () -> SessionUtil.checkIfSoteriaAuthnEnabled(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS));
+      Assertions.assertThrows(
+          SFException.class,
+          () ->
+              SessionUtil.checkIfSoteriaAuthnEnabled(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN));
+
+      snowflakeUtilMockedStatic
+          .when(() -> SnowflakeUtil.systemGetProperty("snowflake.jdbc.enableSoteria"))
+          .thenReturn("true");
+      Assertions.assertDoesNotThrow(
+          () -> SessionUtil.checkIfSoteriaAuthnEnabled(AuthenticatorType.OAUTH_AUTHORIZATION_CODE));
+      Assertions.assertDoesNotThrow(
+          () -> SessionUtil.checkIfSoteriaAuthnEnabled(AuthenticatorType.OAUTH_CLIENT_CREDENTIALS));
+      Assertions.assertDoesNotThrow(
+          () ->
+              SessionUtil.checkIfSoteriaAuthnEnabled(AuthenticatorType.PROGRAMMATIC_ACCESS_TOKEN));
+    }
+  }
+
   private void resetOcspConfiguration() {
     SFTrustManager.SF_OCSP_RESPONSE_CACHE_SERVER_URL_VALUE = null;
     SFTrustManager.SF_OCSP_RESPONSE_CACHE_SERVER_RETRY_URL_PATTERN = null;
diff --git a/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java b/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java
index 0524ab6b8..88451aa0e 100644
--- a/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java
+++ b/src/test/java/net/snowflake/client/core/SnowflakeMFACacheTest.java
@@ -317,7 +317,7 @@ private void testUnavailableLSSWindowsHelper() throws SQLException {
     try {
       SecureStorageWindowsManager.Advapi32LibManager.setInstance(new MockUnavailableAdvapi32Lib());
       SecureStorageWindowsManager manager = SecureStorageWindowsManager.builder();
-      CredentialManager.getInstance().injectSecureStorageManager(manager);
+      CredentialManager.injectSecureStorageManager(manager);
       unavailableLSSWindowsTestBody();
     } finally {
       SecureStorageWindowsManager.Advapi32LibManager.resetInstance();
@@ -329,7 +329,7 @@ public void testUnavailableLocalSecureStorage() throws SQLException {
     try {
       testUnavailableLSSWindowsHelper();
     } finally {
-      CredentialManager.getInstance().resetSecureStorageManager();
+      CredentialManager.resetSecureStorageManager();
     }
   }
 
diff --git a/src/test/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandlerTest.java b/src/test/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandlerTest.java
new file mode 100644
index 000000000..ce22ef531
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/auth/oauth/AuthorizationCodeRedirectRequestHandlerTest.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.nimbusds.oauth2.sdk.id.State;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import net.snowflake.client.core.SFException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+public class AuthorizationCodeRedirectRequestHandlerTest {
+
+  CompletableFuture<String> authorizationCodeFutureMock = Mockito.mock(CompletableFuture.class);
+
+  @Test
+  public void shouldReturnSuccessResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("code", "some authorization code");
+    params.put("state", "abc");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock).complete("some authorization code");
+    Assertions.assertEquals("Authorization completed successfully.", response);
+  }
+
+  @Test
+  public void shouldReturnRandomErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("error", "some random error");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals("Authorization error: some random error", response);
+  }
+
+  @Test
+  public void shouldReturnInvalidStateErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("authorization_code", "some authorization code");
+    params.put("state", "invalid state");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals(
+        "Authorization error: invalid authorization request redirection state", response);
+  }
+
+  @Test
+  public void shouldReturnAuthorizationCodeAbsentErrorResponse() {
+    Map<String, String> params = new HashMap<>();
+    params.put("state", "abc");
+    params.put("some-random-param", "some-value");
+
+    String response =
+        AuthorizationCodeRedirectRequestHandler.handleRedirectRequest(
+            params, authorizationCodeFutureMock, new State("abc"));
+    Mockito.verify(authorizationCodeFutureMock)
+        .completeExceptionally(Mockito.any(SFException.class));
+    Assertions.assertEquals(
+        "Authorization error: authorization code has not been returned to the driver.", response);
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactoryTest.java b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactoryTest.java
new file mode 100644
index 000000000..b359de209
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthAccessTokenProviderFactoryTest.java
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import java.util.Arrays;
+import net.snowflake.client.core.SFException;
+import net.snowflake.client.core.SFLoginInput;
+import net.snowflake.client.core.SFOauthLoginInput;
+import net.snowflake.client.core.auth.AuthenticatorType;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class OAuthAccessTokenProviderFactoryTest {
+
+  private final OAuthAccessTokenProviderFactory providerFactory =
+      new OAuthAccessTokenProviderFactory(null, 30);
+
+  @Test
+  public void shouldProperlyReturnIfAuthenticatorIsEligible() {
+    Arrays.stream(AuthenticatorType.values())
+        .forEach(
+            authenticatorType -> {
+              if (authenticatorType == AuthenticatorType.OAUTH_CLIENT_CREDENTIALS
+                  || authenticatorType.equals(AuthenticatorType.OAUTH_AUTHORIZATION_CODE)) {
+                Assertions.assertTrue(
+                    OAuthAccessTokenProviderFactory.isEligible(authenticatorType));
+              } else {
+                Assertions.assertFalse(
+                    OAuthAccessTokenProviderFactory.isEligible(authenticatorType));
+              }
+            });
+  }
+
+  @Test
+  public void shouldProperlyCreateClientCredentialsAccessTokenProvider() throws SFException {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", "some/url", null);
+    AccessTokenProvider provider =
+        providerFactory.createAccessTokenProvider(
+            AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput);
+    Assertions.assertNotNull(provider);
+    Assertions.assertInstanceOf(OAuthClientCredentialsAccessTokenProvider.class, provider);
+  }
+
+  @Test
+  public void shouldFailToCreateClientCredentialsAccessTokenProviderWithoutClientId() {
+    SFLoginInput loginInput = createLoginInputStub(null, "123", "some/url", null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains("passing clientId is required for OAUTH_CLIENT_CREDENTIALS authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateClientCredentialsAccessTokenProviderWithoutClientSecret() {
+    SFLoginInput loginInput = createLoginInputStub("123", null, "some/url", null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing clientSecret is required for OAUTH_CLIENT_CREDENTIALS authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateClientCredentialsAccessTokenProviderWithoutClientAuthzUrl() {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", null, null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_CLIENT_CREDENTIALS, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing externalTokenRequestUrl is required for OAUTH_CLIENT_CREDENTIALS authentication."));
+  }
+
+  @Test
+  public void shouldProperlyCreateAuthorizationCodeAccessTokenProvider() throws SFException {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", "", null);
+    AccessTokenProvider provider =
+        providerFactory.createAccessTokenProvider(
+            AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput);
+    Assertions.assertNotNull(provider);
+    Assertions.assertInstanceOf(OAuthAuthorizationCodeAccessTokenProvider.class, provider);
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithoutClientId() {
+    SFLoginInput loginInput = createLoginInputStub(null, "123", "some/url", null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains("passing clientId is required for OAUTH_AUTHORIZATION_CODE authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithoutClientSecret() {
+    SFLoginInput loginInput = createLoginInputStub("123", null, null, null);
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage()
+            .contains(
+                "passing clientSecret is required for OAUTH_AUTHORIZATION_CODE authentication."));
+  }
+
+  @Test
+  public void shouldFailToCreateAuthzCodeAccessTokenProviderWithHttpsRedirectUri() {
+    SFLoginInput loginInput = createLoginInputStub("123", "123", null, "https://localhost:1234/");
+    SFException e =
+        Assertions.assertThrows(
+            SFException.class,
+            () ->
+                providerFactory.createAccessTokenProvider(
+                    AuthenticatorType.OAUTH_AUTHORIZATION_CODE, loginInput));
+    Assertions.assertTrue(
+        e.getMessage().contains("provided redirect URI should start with \"http\", not \"https\""));
+  }
+
+  private SFLoginInput createLoginInputStub(
+      String clientId, String clientSecret, String externalTokenUrl, String redirectUri) {
+    SFLoginInput loginInput = new SFLoginInput();
+    loginInput.setOauthLoginInput(
+        new SFOauthLoginInput(clientId, clientSecret, redirectUri, null, externalTokenUrl, null));
+    return loginInput;
+  }
+}
diff --git a/src/test/java/net/snowflake/client/core/auth/oauth/OAuthUtilTest.java b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthUtilTest.java
new file mode 100644
index 000000000..000b96b4f
--- /dev/null
+++ b/src/test/java/net/snowflake/client/core/auth/oauth/OAuthUtilTest.java
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved.
+ */
+
+package net.snowflake.client.core.auth.oauth;
+
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringWriter;
+import java.net.URI;
+import net.snowflake.client.core.SFOauthLoginInput;
+import org.apache.commons.io.IOUtils;
+import org.apache.http.Header;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpRequestBase;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class OAuthUtilTest {
+
+  private static final String BASE_SERVER_URL_FROM_LOGIN_INPUT = "http://some.snowflake.server.com";
+  public static final String ROLE_FROM_LOGIN_INPUT = "ANALYST";
+
+  @Test
+  public void shouldCreateDefaultAuthorizationUrl() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    URI authorizationUrl =
+        OAuthUtil.getAuthorizationUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(authorizationUrl);
+    Assertions.assertEquals(
+        "http://some.snowflake.server.com/oauth/authorize", authorizationUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateUserSuppliedAuthorizationUrl() {
+    SFOauthLoginInput loginInput =
+        createLoginInputStub("http://some.external.authorization.url.com/authz", null, null, null);
+    URI tokenRequestUrl =
+        OAuthUtil.getAuthorizationUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(tokenRequestUrl);
+    Assertions.assertEquals(
+        "http://some.external.authorization.url.com/authz", tokenRequestUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateDefaultTokenRequestUrl() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(tokenRequestUrl);
+    Assertions.assertEquals(
+        "http://some.snowflake.server.com/oauth/token-request", tokenRequestUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateUserSuppliedTokenRequestUrl() {
+    SFOauthLoginInput loginInput =
+        createLoginInputStub(
+            null, "http://some.external.authorization.url.com/token-request", null, null);
+    URI tokenRequestUrl =
+        OAuthUtil.getTokenRequestUrl(loginInput, BASE_SERVER_URL_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(tokenRequestUrl);
+    Assertions.assertEquals(
+        "http://some.external.authorization.url.com/token-request", tokenRequestUrl.toString());
+  }
+
+  @Test
+  public void shouldCreateDefaultScope() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    String scope = OAuthUtil.getScope(loginInput, ROLE_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(scope);
+    Assertions.assertEquals("session:role:ANALYST", scope);
+  }
+
+  @Test
+  public void shouldCreateUserSuppliedScope() {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, "some:custom:SCOPE", null);
+    String scope = OAuthUtil.getScope(loginInput, ROLE_FROM_LOGIN_INPUT);
+    Assertions.assertNotNull(scope);
+    Assertions.assertEquals("some:custom:SCOPE", scope);
+  }
+
+  @Test
+  public void shouldCreateDefaultRedirectUri() throws IOException {
+    SFOauthLoginInput loginInput = createLoginInputStub(null, null, null, null);
+    URI redirectUri = OAuthUtil.buildRedirectUri(loginInput);
+    Assertions.assertNotNull(redirectUri);
+    Assertions.assertTrue(
+        redirectUri.toString().matches("^http://127.0.0.1:([0-9]*)/"),
+        "Invalid redirect URI: " + redirectUri);
+  }
+
+  @Test
+  public void shouldCreateCustomRedirectUri() throws IOException {
+    SFOauthLoginInput loginInput =
+        createLoginInputStub(null, null, null, "http://localhost:8989/some-endpoint");
+    URI redirectUri = OAuthUtil.buildRedirectUri(loginInput);
+    Assertions.assertNotNull(redirectUri);
+    Assertions.assertEquals("http://localhost:8989/some-endpoint", redirectUri.toString());
+  }
+
+  @Test
+  public void shouldConvertToBaseAuthorizationRequest() throws IOException {
+    HTTPRequest httpRequest =
+        new HTTPRequest(
+            HTTPRequest.Method.POST, URI.create("https://some.snowflake.server.com/oauth/token"));
+    httpRequest.setAccept("application/json");
+    httpRequest.setAuthorization("Bearer some-token");
+    httpRequest.setBody("{\"grant_type\":\"authorization_code\",\"code\":\"some-code\"}");
+
+    HttpRequestBase httpRequestBase = OAuthUtil.convertToBaseAuthorizationRequest(httpRequest);
+    Assertions.assertNotNull(httpRequestBase);
+    Assertions.assertEquals(HttpPost.class, httpRequestBase.getClass());
+    Assertions.assertEquals(
+        "https://some.snowflake.server.com/oauth/token", httpRequestBase.getURI().toString());
+    Header[] allHeaders = httpRequestBase.getAllHeaders();
+    Assertions.assertNotNull(allHeaders);
+    Assertions.assertEquals(2, allHeaders.length);
+    Assertions.assertEquals("Accept", allHeaders[0].getName());
+    Assertions.assertEquals("application/json", allHeaders[0].getValue());
+    Assertions.assertEquals("Authorization", allHeaders[1].getName());
+    Assertions.assertEquals("Bearer some-token", allHeaders[1].getValue());
+
+    StringWriter writer = new StringWriter();
+    try (InputStream ins = ((HttpPost) httpRequestBase).getEntity().getContent()) {
+      IOUtils.copy(ins, writer, "UTF-8");
+    }
+    Assertions.assertEquals(
+        "{\"grant_type\":\"authorization_code\",\"code\":\"some-code\"}", writer.toString());
+  }
+
+  private SFOauthLoginInput createLoginInputStub(
+      String externalAuthorizationUrl,
+      String externalTokenRequestUrl,
+      String scope,
+      String redirectUri) {
+    return new SFOauthLoginInput(
+        null, null, redirectUri, externalAuthorizationUrl, externalTokenRequestUrl, scope);
+  }
+}
diff --git a/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java b/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java
index 08069b95c..49d0dcdc0 100644
--- a/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java
+++ b/src/test/java/net/snowflake/client/jdbc/BaseWiremockTest.java
@@ -10,15 +10,19 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.net.ServerSocket;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Paths;
 import java.time.Duration;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Properties;
 import net.snowflake.client.core.HttpUtil;
 import net.snowflake.client.log.SFLogger;
 import net.snowflake.client.log.SFLoggerFactory;
+import org.apache.commons.io.IOUtils;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
@@ -30,7 +34,7 @@
 import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.BeforeAll;
 
-abstract class BaseWiremockTest {
+public abstract class BaseWiremockTest {
 
   protected static final SFLogger logger = SFLoggerFactory.getLogger(BaseWiremockTest.class);
   protected static final String WIREMOCK_HOME_DIR = ".wiremock";
@@ -38,6 +42,7 @@ abstract class BaseWiremockTest {
       "/.m2/repository/org/wiremock/wiremock-standalone/3.8.0/wiremock-standalone-3.8.0.jar";
   protected static final String WIREMOCK_HOST = "localhost";
   protected static final String TRUST_STORE_PROPERTY = "javax.net.ssl.trustStore";
+  protected static final String MAPPINGS_BASE_DIR = "/wiremock/mappings";
   protected static int wiremockHttpPort;
   protected static int wiremockHttpsPort;
   private static String originalTrustStorePath;
@@ -237,4 +242,13 @@ protected void addMapping(String mapping) {
       throw new RuntimeException(e);
     }
   }
+
+  protected void importMappingFromResources(String relativePath) {
+    try (InputStream is = BaseWiremockTest.class.getResourceAsStream(relativePath)) {
+      String scenario = IOUtils.toString(Objects.requireNonNull(is), StandardCharsets.UTF_8);
+      importMapping(scenario);
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
 }
diff --git a/src/test/java/net/snowflake/client/jdbc/SessionUtilTest.java b/src/test/java/net/snowflake/client/jdbc/SessionUtilTest.java
deleted file mode 100644
index 4056dda1b..000000000
--- a/src/test/java/net/snowflake/client/jdbc/SessionUtilTest.java
+++ /dev/null
@@ -1,74 +0,0 @@
-package net.snowflake.client.jdbc;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import java.util.Map;
-import net.snowflake.client.core.ObjectMapperFactory;
-import net.snowflake.client.core.SessionUtil;
-import org.junit.jupiter.api.Test;
-
-public class SessionUtilTest {
-  @Test
-  public void testGetCommonParams() throws Exception {
-    ObjectMapper mapper = ObjectMapperFactory.getObjectMapper();
-
-    // Test unknown param name
-    Map<String, Object> result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": true}]"));
-    assertTrue((boolean) result.get("testParam"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": false}]"));
-    assertFalse((boolean) result.get("testParam"));
-
-    result =
-        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"testParam\", \"value\": 0}]"));
-    assertEquals(0, (int) result.get("testParam"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": 1000}]"));
-    assertEquals(1000, (int) result.get("testParam"));
-
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"\"}]"));
-    assertEquals("", result.get("testParam"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"testParam\", \"value\": \"value\"}]"));
-    assertEquals("value", result.get("testParam"));
-
-    // Test known param name
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": true}]"));
-    assertTrue((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"CLIENT_DISABLE_INCIDENTS\", \"value\": false}]"));
-    assertFalse((boolean) result.get("CLIENT_DISABLE_INCIDENTS"));
-
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree(
-                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 0}]"));
-    assertEquals(0, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree(
-                "[{\"name\": \"CLIENT_STAGE_ARRAY_BINDING_THRESHOLD\", \"value\": 1000}]"));
-    assertEquals(1000, (int) result.get("CLIENT_STAGE_ARRAY_BINDING_THRESHOLD"));
-
-    result =
-        SessionUtil.getCommonParams(mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"\"}]"));
-    assertEquals("", result.get("TIMEZONE"));
-    result =
-        SessionUtil.getCommonParams(
-            mapper.readTree("[{\"name\": \"TIMEZONE\", \"value\": \"value\"}]"));
-    assertEquals("value", result.get("TIMEZONE"));
-  }
-}
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/browser_timeout_authorization_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/browser_timeout_authorization_error.json
new file mode 100644
index 000000000..41b5c8045
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/browser_timeout_authorization_error.json
@@ -0,0 +1,16 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Browser Authorization timeout",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 200,
+        "fixedDelayMilliseconds": 5000
+      }
+    }
+  ]
+}
+ 
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/external_idp_custom_urls.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/external_idp_custom_urls.json
new file mode 100644
index 000000000..c03129042
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/external_idp_custom_urls.json
@@ -0,0 +1,76 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Custom urls OAuth authorization code flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authorized",
+      "request": {
+        "urlPathPattern": "/authorization",
+        "method": "GET",
+        "queryParameters": {
+          "response_type": {
+            "equalTo": "code"
+          },
+          "scope": {
+            "equalTo": "session:role:ANALYST"
+          },
+          "code_challenge_method": {
+            "equalTo": "S256"
+          },
+          "redirect_uri": {
+            "equalTo": "http://localhost:8007/snowflake/oauth-redirect"
+          },
+          "code_challenge": {
+            "matches": ".*"
+          },
+          "state": {
+            "matches": ".*"
+          },
+          "client_id": {
+            "equalTo": "123"
+          }
+        }
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8007/snowflake/oauth-redirect?code=123&state=abc123"
+        }
+      }
+    },
+    {
+      "scenarioName": "Custom urls OAuth authorization code flow",
+      "requiredScenarioState": "Authorized",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/tokenrequest.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=authorization_code&code=123&redirect_uri=http%3A%2F%2Flocalhost%3A8007%2Fsnowflake%2Foauth-redirect&code_verifier="
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_scope_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_scope_error.json
new file mode 100644
index 000000000..f92029a2b
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_scope_error.json
@@ -0,0 +1,17 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Invalid scope authorization error",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8002/snowflake/oauth-redirect?error=invalid_scope&error_description=One+or+more+scopes+are+not+configured+for+the+authorization+server+resource."
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_state_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_state_error.json
new file mode 100644
index 000000000..fb19c1cba
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/invalid_state_error.json
@@ -0,0 +1,17 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Invalid scope authorization error",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8010/snowflake/oauth-redirect?code=123&state=invalidstate"
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/successful_flow.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/successful_flow.json
new file mode 100644
index 000000000..f49b224b4
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/successful_flow.json
@@ -0,0 +1,77 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful OAuth authorization code flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authorized",
+      "request": {
+        "urlPathPattern": "/oauth/authorize",
+        "queryParameters": {
+          "response_type": {
+            "equalTo": "code"
+          },
+          "scope": {
+            "equalTo": "session:role:ANALYST"
+          },
+          "code_challenge_method": {
+            "equalTo": "S256"
+          },
+          "redirect_uri": {
+            "equalTo": "http://localhost:8009/snowflake/oauth-redirect"
+          },
+          "code_challenge": {
+            "matches": ".*"
+          },
+          "state": {
+            "matches": ".*"
+          },
+          "client_id": {
+            "equalTo": "123"
+          }
+        },
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8009/snowflake/oauth-redirect?code=123&state=abc123"
+        }
+      }
+    },
+    {
+      "scenarioName": "Successful OAuth authorization code flow",
+      "requiredScenarioState": "Authorized",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=authorization_code&code=123&redirect_uri=http%3A%2F%2Flocalhost%3A8009%2Fsnowflake%2Foauth-redirect&code_verifier="
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/authorization_code/token_request_error.json b/src/test/resources/wiremock/mappings/oauth/authorization_code/token_request_error.json
new file mode 100644
index 000000000..792e1e363
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/authorization_code/token_request_error.json
@@ -0,0 +1,44 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "OAuth token request error",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authorized",
+      "request": {
+        "urlPathPattern": "/oauth/authorize.*",
+        "method": "GET"
+      },
+      "response": {
+        "status": 302,
+        "headers": {
+          "Location": "http://localhost:8003/snowflake/oauth-redirect?code=123&state=abc123"
+        }
+      }
+    },
+    {
+      "scenarioName": "OAuth token request error",
+      "requiredScenarioState": "Authorized",
+      "newScenarioState": "Token request error",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=authorization_code&code=123&redirect_uri=http%3A%2F%2Flocalhost%3A8003%2Fsnowflake%2Foauth-redirect&code_verifier="
+          }
+        ]
+      },
+      "response": {
+        "status": 400
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/client_credentials/successful_flow.json b/src/test/resources/wiremock/mappings/oauth/client_credentials/successful_flow.json
new file mode 100644
index 000000000..10ed78c84
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/client_credentials/successful_flow.json
@@ -0,0 +1,39 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful OAuth client credentials flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/client_credentials/token_request_error.json b/src/test/resources/wiremock/mappings/oauth/client_credentials/token_request_error.json
new file mode 100644
index 000000000..72eb97481
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/client_credentials/token_request_error.json
@@ -0,0 +1,29 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "OAuth client credentials flow with token request error",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Acquired access token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 400
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/caching_refreshed_access_token_and_new_refresh_token.json b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_refreshed_access_token_and_new_refresh_token.json
new file mode 100644
index 000000000..86fefd68c
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_refreshed_access_token_and_new_refresh_token.json
@@ -0,0 +1,173 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Caching refreshed access token and new refresh token",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Caching refreshed access token and new refresh token",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Acquired new access token and new refresh token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=refresh_token&refresh_token=some-refresh-token-123&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token" : "new-refreshed-access-token-123",
+          "refresh_token": "new-refresh-token-123",
+          "token_type" : "Bearer",
+          "expires_in" : 599,
+          "idpInitiated" : false
+        }
+      }
+    },
+    {
+      "scenarioName": "Caching refreshed access token and new refresh token",
+      "requiredScenarioState": "Acquired new access token and new refresh token",
+      "newScenarioState": "Established session with newly acquired access token and cache both tokens",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "new-refreshed-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/caching_tokens_after_connecting.json b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_tokens_after_connecting.json
new file mode 100644
index 000000000..20a04d615
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/caching_tokens_after_connecting.json
@@ -0,0 +1,119 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful writing access token and refresh token to empty cache",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Acquired tokens",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "access-token-123",
+          "refresh_token": "refresh-token-123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }      }
+    },
+    {
+      "scenarioName": "Successful writing access token and refresh token to empty cache",
+      "requiredScenarioState": "Acquired tokens",
+      "newScenarioState": "Cached tokens",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/refreshing_expired_access_token.json b/src/test/resources/wiremock/mappings/oauth/token_caching/refreshing_expired_access_token.json
new file mode 100644
index 000000000..6fe251ed1
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/refreshing_expired_access_token.json
@@ -0,0 +1,172 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Refreshing expired access token from cache",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Refreshing expired access token from cache",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Acquired new access token using refresh token",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=refresh_token&refresh_token=some-refresh-token-123&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token" : "new-refreshed-access-token-123",
+          "token_type" : "Bearer",
+          "expires_in" : 599,
+          "idpInitiated" : false
+        }
+      }
+    },
+    {
+      "scenarioName": "Refreshing expired access token from cache",
+      "requiredScenarioState": "Acquired new access token using refresh token",
+      "newScenarioState": "Established session with newly acquired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "new-refreshed-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_expiration_and_no_refresh_token.json b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_expiration_and_no_refresh_token.json
new file mode 100644
index 000000000..45599a369
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_expiration_and_no_refresh_token.json
@@ -0,0 +1,174 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Restarting full flow on access token expiration but no refresh token",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token expiration but no refresh token",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Acquired new access token via Client Credentials flow (no refresh token in cache)",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "newly-obtained-access-token-123",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "session:role:ANALYST",
+          "expires_in": 600,
+          "idpInitiated": false
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token expiration but no refresh token",
+      "requiredScenarioState": "Acquired new access token via Client Credentials flow (no refresh token in cache)",
+      "newScenarioState": "Established session with newly acquired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "newly-obtained-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_refresh_token_error.json b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_refresh_token_error.json
new file mode 100644
index 000000000..f03c0ffe7
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/restarting_full_flow_on_refresh_token_error.json
@@ -0,0 +1,204 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Removed expired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "expired-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "OAUTH",
+            "signInOptions": {}
+          },
+          "code": "390318",
+          "message": "OAuth access token expired. [1172527951366]",
+          "success": false,
+          "headers": null
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Removed expired access token",
+      "newScenarioState": "Refreshing token error",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=refresh_token&refresh_token=some-refresh-token-123&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 400,
+        "jsonBody": {
+          "error": "Invalid refresh token"
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Refreshing token error",
+      "newScenarioState": "Acquired new access token via Client Credentials flow",
+      "request": {
+        "urlPathPattern": "/oauth/token-request.*",
+        "method": "POST",
+        "headers": {
+          "Authorization": {
+            "contains": "Basic"
+          },
+          "Content-Type": {
+            "contains": "application/x-www-form-urlencoded; charset=UTF-8"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "contains": "grant_type=client_credentials&scope=session%3Arole%3AANALYST"
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "access_token": "newly-obtained-access-token-123",
+          "refresh_token": "newly-obtained-refresh-token",
+          "token_type": "Bearer",
+          "username": "user",
+          "scope": "refresh_token session:role:ANALYST",
+          "expires_in": 600,
+          "refresh_token_expires_in": 86399,
+          "idpInitiated": false
+        }
+      }
+    },
+    {
+      "scenarioName": "Restarting full flow on access token refreshing error",
+      "requiredScenarioState": "Acquired new access token via Client Credentials flow",
+      "newScenarioState": "Established session with newly acquired access token",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson": {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "newly-obtained-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements": true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/oauth/token_caching/reusing_cached_access_token_to_authenticate.json b/src/test/resources/wiremock/mappings/oauth/token_caching/reusing_cached_access_token_to_authenticate.json
new file mode 100644
index 000000000..9775f0148
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/oauth/token_caching/reusing_cached_access_token_to_authenticate.json
@@ -0,0 +1,85 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Reusing access token and refresh token from cache",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Reusing cached tokens",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "reused-access-token-123",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "OAUTH"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/pat/invalid_pat_token.json b/src/test/resources/wiremock/mappings/pat/invalid_pat_token.json
new file mode 100644
index 000000000..69ffe0cf9
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/pat/invalid_pat_token.json
@@ -0,0 +1,60 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful PAT authentication flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authenticated",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "MOCK_TOKEN",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "PROGRAMMATIC_ACCESS_TOKEN"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "nextAction": "RETRY_LOGIN",
+            "authnMethod": "PAT",
+            "signInOptions": {}
+          },
+          "code": "394400",
+          "message": "Programmatic access token is invalid.",
+          "success": false,
+          "headers": null
+        }
+      }
+    }
+  ]
+}
diff --git a/src/test/resources/wiremock/mappings/pat/successful_flow.json b/src/test/resources/wiremock/mappings/pat/successful_flow.json
new file mode 100644
index 000000000..2f25b4088
--- /dev/null
+++ b/src/test/resources/wiremock/mappings/pat/successful_flow.json
@@ -0,0 +1,85 @@
+{
+  "mappings": [
+    {
+      "scenarioName": "Successful PAT authentication flow",
+      "requiredScenarioState": "Started",
+      "newScenarioState": "Authenticated",
+      "request": {
+        "urlPathPattern": "/session/v1/login-request.*",
+        "method": "POST",
+        "headers": {
+          "CLIENT_APP_ID": {
+            "equalTo": "MOCK_APP_ID"
+          },
+          "CLIENT_APP_VERSION": {
+            "equalTo": "MOCK_APP_VERSION"
+          },
+          "Authorization": {
+            "equalTo": "Basic"
+          },
+          "accept": {
+            "equalTo": "application/json"
+          }
+        },
+        "bodyPatterns": [
+          {
+            "equalToJson" : {
+              "data": {
+                "ACCOUNT_NAME": "MOCK_ACCOUNT_NAME",
+                "CLIENT_APP_ID": "MOCK_APP_ID",
+                "CLIENT_ENVIRONMENT": {
+                  "tracing": "INFO",
+                  "OCSP_MODE": "FAIL_OPEN"
+                },
+                "CLIENT_APP_VERSION": "MOCK_APP_VERSION",
+                "TOKEN": "MOCK_TOKEN",
+                "LOGIN_NAME": "MOCK_USERNAME",
+                "AUTHENTICATOR": "PROGRAMMATIC_ACCESS_TOKEN"
+              }
+            },
+            "ignoreExtraElements" : true
+          }
+        ]
+      },
+      "response": {
+        "status": 200,
+        "jsonBody": {
+          "data": {
+            "masterToken": "master token",
+            "token": "session token",
+            "validityInSeconds": 3600,
+            "masterValidityInSeconds": 14400,
+            "displayUserName": "OAUTH_TEST_AUTH_CODE",
+            "serverVersion": "8.48.0 b2024121104444034239f05",
+            "firstLogin": false,
+            "remMeToken": null,
+            "remMeValidityInSeconds": 0,
+            "healthCheckInterval": 45,
+            "newClientForUpgrade": "3.12.3",
+            "sessionId": 1172562260498,
+            "parameters": [
+              {
+                "name": "CLIENT_PREFETCH_THREADS",
+                "value": 4
+              }
+            ],
+            "sessionInfo": {
+              "databaseName": "TEST_DHEYMAN",
+              "schemaName": "TEST_JDBC",
+              "warehouseName": "TEST_XSMALL",
+              "roleName": "ANALYST"
+            },
+            "idToken": null,
+            "idTokenValidityInSeconds": 0,
+            "responseData": null,
+            "mfaToken": null,
+            "mfaTokenValidityInSeconds": 0
+          },
+          "code": null,
+          "message": null,
+          "success": true
+        }
+      }
+    }
+  ]
+}
diff --git a/thin_public_pom.xml b/thin_public_pom.xml
index 09c6bf079..b8527cade 100644
--- a/thin_public_pom.xml
+++ b/thin_public_pom.xml
@@ -55,11 +55,11 @@
     <javax.servlet.version>3.1.0</javax.servlet.version>
     <jna.version>5.13.0</jna.version>
     <joda.time.version>2.8.1</joda.time.version>
-    <json.smart.version>2.4.9</json.smart.version>
+    <json.smart.version>2.5.1</json.smart.version>
     <jsoup.version>1.15.3</jsoup.version>
     <metrics.version>2.2.0</metrics.version>
     <netty.version>4.1.115.Final</netty.version>
-    <nimbusds.version>9.37.3</nimbusds.version>
+    <nimbusds.version>9.40.0</nimbusds.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <slf4j.version>2.0.13</slf4j.version>
@@ -194,6 +194,11 @@
       <artifactId>nimbus-jose-jwt</artifactId>
       <version>${nimbusds.version}</version>
     </dependency>
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>oauth2-oidc-sdk</artifactId>
+      <version>${nimbusds.oauth2.version}</version>
+    </dependency>
     <dependency>
       <groupId>com.yammer.metrics</groupId>
       <artifactId>metrics-core</artifactId>