Python requests getting 401 on CXone client_credentials grant

Trying to grab a token for our custom DFO channel backend using Python requests. The docs say client_credentials works, but I’m hitting a 401. Here’s the snippet:

import requests
url = ‘https://api.mypurecloud.com/oauth/token
resp = requests.post(url, data={‘grant_type’: ‘client_credentials’}, auth=(client_id, client_secret))
print(resp.status_code, resp.text)

Returns 401 Unauthorized. I’ve verified the credentials are correct and the app has the right scopes. Is the auth header format wrong or am I missing something obvious in the payload?