CXone Client Credentials Auth returning 400 Invalid Grant

Getting a 400 error when trying to get a token for our WFM integration. The error says invalid_grant. I’m using the client_credentials flow as shown in the docs.

POST /api/v2/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=MY_ID&client_secret=MY_SECRET

The ID and secret are copied straight from the portal. Is there a specific scope I need to include for WFM data? Or is the endpoint different for CXone vs ?