Client_credentials grant failing for CXone API

Trying to get an access token for CXone using the client_credentials flow. The endpoint works fine for Genesys Cloud, but CXone returns a 401. Here’s the curl:

curl -X POST https://api.copilot.nice.incontact.com/oauth2/token \
 -u "CLIENT_ID:CLIENT_SECRET" \
 -d "grant_type=client_credentials&scope=nicecxone:api"

Response is just invalid_client. Am I missing a specific scope or is the endpoint wrong?