Python requests getting 401 on Genesys OAuth token endpoint

Trying to script a simple OAuth2 Client Credentials flow using Python requests to grab an access token. We’ve been using the SDK, but it’s too heavy for this quick maintenance script. The docs say to POST to /oauth/token, but I keep hitting a 401 Unauthorized. I’ve double-checked the client ID and secret against the admin UI. Here’s the snippet:

import requests

url = "https://api.mypurecloud.com/oauth/token"
headers = {
 "Content-Type": "application/x-www-form-urlencoded"
}
payload = {
 "grant_type": "client_credentials",
 "client_id": "my-client-id",
 "client_secret": "my-secret"
}

response = requests.post(url, headers=headers, data=payload)
print(response.status_code)
print(response.text)

The response is 401 and the body says invalid_client. I’m not base64 encoding the credentials in the header because the form data method should work. Am I missing a scope parameter or is the endpoint wrong? The docs are a bit sparse on the raw HTTP details.