CXone client_credentials grant failing with 401 on specific region endpoint

Running into a weird auth issue with the NICE CXone API. I’m trying to set up a background service that pulls conversation data using the client_credentials grant type. The docs say it’s straightforward, but the /oauth/token endpoint is throwing a 401 Unauthorized.

Here’s the curl command I’m using to test:

curl -X POST https://api.cxone.com/oauth/token
-H “Content-Type: application/x-www-form-urlencoded”
-d “grant_type=client_credentials&client_id=MY_CLIENT_ID&client_secret=MY_SECRET&scope=conversation:read”

The response is just {"error":"invalid_grant","error_description":"Bad credentials"}.

I’ve double-checked the ID and secret. They work fine in Postman when I manually paste them in. I’ve also verified the client ID is assigned to the correct org. The weird part is this works perfectly for our US-based instances. It’s only failing for the EU region endpoint.

I tried swapping the base URL to https://api.eu.cxone.com/oauth/token but that gives a 404. The docs don’t mention regional subdomains for the OAuth service.

I’ve checked the network traffic. The request is hitting the right IP. No firewall blocks. The timestamp on my server is synced. I even tried adding a realm parameter just in case, but that didn’t change anything.

Is there a specific header or query param I’m missing for the EU region? Or is this a known issue with the client_credentials flow in certain data centers?

I’ve got a dead letter queue filling up because these tokens aren’t generating. Need to get this resolved before the weekend.

Docs state: “The authorization header must use Basic authentication with the client ID and secret encoded in base64.” You’re likely missing the header or encoding it wrong. Try echo -n 'clientId:clientSecret' | base64 and add Authorization: Basic <output> to the request.