cat << 'EOF' | git apply
diff --git a/src/snowflake/connector/auth/oauth_code.py b/src/snowflake/connector/auth/oauth_code.py
--- a/src/snowflake/connector/auth/oauth_code.py
+++ b/src/snowflake/connector/auth/oauth_code.py
@@ -17,6 +17,7 @@
 
 from ..compat import parse_qs, urlparse, urlsplit
 from ..constants import OAUTH_TYPE_AUTHORIZATION_CODE
+import urllib.parse
 from ..errorcode import (
     ER_OAUTH_CALLBACK_ERROR,
     ER_OAUTH_SERVER_TIMEOUT,
@@ -344,7 +345,7 @@
             "We were unable to open a browser window for you, "
             "please open the URL manually then paste the "
             "URL you are redirected to into the terminal:\n"
-            f"{authorization_request}"
+            f"{self._redact_sensitive_query_params(authorization_request)}"
         )
         received_redirected_request = input(
             "Enter the URL the OAuth flow redirected you to: "
@@ -366,6 +367,27 @@
             )
         return code, state
 
+    def _redact_sensitive_query_params(self, url: str) -> str:
+        """
+        Redacts sensitive query parameters from the given URL before printing.
+        Currently redacts 'client_id' and 'client_secret' if present.
+        """
+        parsed_url = urllib.parse.urlparse(url)
+        query = urllib.parse.parse_qs(parsed_url.query, keep_blank_values=True)
+        redacted = False
+        for param in ["client_id", "client_secret"]:
+            if param in query:
+                query[param] = ["***REDACTED***"]
+                redacted = True
+        if redacted:
+            # Reconstruct the query string
+            new_query = urllib.parse.urlencode(query, doseq=True)
+            # Reconstruct the URL
+            url = urllib.parse.urlunparse(
+                parsed_url._replace(query=new_query)
+            )
+        return url
+
     def _parse_authorization_redirected_request(
         self,
         url: str,
EOF