CXone client_credentials grant returning 401 with valid app ID

Trying to get an access token from CXone using client_credentials but getting a 401 Unauthorized error.

I’m hitting the endpoint with basic auth and grant type.

POST https://api.nice.incontact.com/oauth2/token
Headers: Authorization: Basic <base64(appId:secret)>
Body: grant_type=client_credentials

The app ID and secret are correct and the app has the right permissions. Is there a specific scope I need to include in the body for this grant type?