Python requests returning 401 for Genesys Cloud OAuth2 client credentials

I’ve been trying to script an automation task to pull user data using the Genesys Cloud Platform API. I need to get an access token first using the OAuth2 client credentials flow. I’m using Python 3.9 and the requests library. The documentation says I should POST to https://{{environment}}.mypurecloud.com/api/v2/oauth/token.

Here is the snippet I’m using:

import requests

url = "https://api.mypurecloud.com/api/v2/oauth/token"
headers = {
 "Content-Type": "application/x-www-form-urlencoded"
}
payload = {
 "grant_type": "client_credentials",
 "client_id": "my_client_id",
 "client_secret": "my_secret",
 "scope": "admin"
}

response = requests.post(url, data=payload, headers=headers)
print(response.status_code)
print(response.json())

The issue is that I keep getting a 401 Unauthorized error. The response JSON says "error": "invalid_client". I have double-checked the client ID and secret in the Developer Console under API Credentials. The credentials were generated just yesterday. I tried changing the scope to platform-api as well but it makes no difference. The environment is US East. Is there something specific about the Content-Type header or the way the payload needs to be encoded? I feel like I’m missing a basic step here. It works fine in Postman but fails in code.