Python requests OAuth2 token generation failing with 401 for Genesys Cloud

I’m trying to script a token generation flow in Python to feed into my OpenTelemetry tracing pipeline. The goal is to use the Client Credentials grant type against the Genesys Cloud OAuth endpoint, but the requests library keeps throwing a 401 Unauthorized error. I’ve double-checked the client ID and secret in my environment variables, and the endpoint looks correct based on the docs. Here’s the snippet I’m running:

import requests
import json

url = 'https://api.mypurecloud.com/oauth/token'
payload = {
 'grant_type': 'client_credentials',
 'client_id': 'MY_CLIENT_ID',
 'client_secret': 'MY_CLIENT_SECRET'
}
headers = {
 'Content-Type': 'application/x-www-form-urlencoded'
}

response = requests.post(url, data=payload, headers=headers)
print(response.status_code)
print(response.text)

The response body says "error": "invalid_client". I know the credentials are valid because they work in Postman when I send them as form-data. It’s driving me crazy. I’ve tried encoding the client_id and secret in the Authorization header as basic auth per some older examples, but that just gives a 400 Bad Request. Is there something specific about how Genesys Cloud expects the client credentials in the body versus the header for this endpoint? Or maybe a specific scope I need to pass even for client_credentials? I’m stuck on this auth step before I can even start propagating the trace context to the Data Actions.

Spot on with the payload structure. The real gotcha is the Authorization header. It needs to be Basic auth with client_id:client_secret base64 encoded. If that’s still 401, check your redirect URI matches exactly. Here’s the working snippet:

import requests
auth = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()
headers = {"Authorization": f"Basic {auth}", "Content-Type": "application/x-www-form-urlencoded"}
requests.post("https://api.mypurecloud.com/oauth/token", headers=headers, data={"grant_type": "client_credentials"})