CXone client_credentials OAuth flow returns 401

Hitting https://platform.nice.com/oauth2/token with client_credentials grant. Getting 401 Unauthorized back. Credentials are valid in the UI, but the API rejects them. Here’s the cURL:

curl -X POST "https://platform.nice.com/oauth2/token" \
 -u "my_client_id:my_client_secret" \
 -d "grant_type=client_credentials"

Error response:

{"error":"invalid_client","error_description":"Client authentication failed"}

Am I missing a scope parameter or is the region endpoint wrong?