CXone client_credentials grant returning 401

How do I get a valid token using the client_credentials grant in CXone? I’m hitting POST /api/v2/oauth/token with my app id and secret in the body but getting a 401.

{
 "grant_type": "client_credentials",
 "client_id": "my-app-id",
 "client_secret": "my-secret"
}

The docs are vague on the exact format.