CXone API 401 on client_credentials despite valid creds

Getting a 401 Unauthorized when hitting /v1/oauth2/token for client_credentials. The payload looks right:

{
 "grant_type": "client_credentials",
 "scope": "urn:nice:cxone:api"
}

Headers are set to application/x-www-form-urlencoded. The token comes back blank. Any obvious reason this would fail?