SAML SSO blocking programmatic OAuth token requests

We enabled SAML SSO on our CXone tenant. The standard OAuth client_credentials grant now fails with a 401 Unauthorized.

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=xxx&client_secret=yyy

Is there a specific endpoint or header required to bypass SAML for service accounts?