Client_credentials grant failing on CXone /oauth2/token

Trying to get a bearer token for CXone using client_credentials. The docs show a POST to /oauth2/token with content-type application/x-www-form-urlencoded. I’m sending the client_id and client_secret in the body but getting a 400 back. Here’s the payload I’m using:

grant_type=client_credentials&client_id=MY_ID&client_secret=MY_SECRET

What am I missing?