Python requests OAuth2 token 401 with correct creds

Why is my Python requests call to /api/v2/oauth/token returning 401? I’ve verified the client_id and client_secret match the app settings. Using client_credentials grant. Here’s the snippet:

import requests
res = requests.post('https://api.mypurecloud.com/api/v2/oauth/token', auth=(client_id, client_secret), data={'grant_type': 'client_credentials'})
print(res.status_code, res.json())

Response is just {'error': 'invalid_client'}. No idea what’s wrong.