CXone client_credentials grant returning 401 Bad Request

Trying to set up a service account to hit the CXone Admin API directly from a Node.js backend. I’m using the client_credentials grant type as documented. The request looks right, but I keep hitting a 401.

Here’s the fetch call:

const res = await fetch('https://platform.niceincontact.com/oauth2/token', {
 method: 'POST',
 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
 body: new URLSearchParams({
 grant_type: 'client_credentials',
 client_id: process.env.CX_CLIENT_ID,
 client_secret: process.env.CX_CLIENT_SECRET,
 scope: 'admin:agent:read'
 })
});

The response body is empty. Checked the secret twice. Is there a specific scope required just to get the token?